GitHub Advisoryadvisory · Maven

GHSA-m88m-crr9-jvqq OpenRefine vulnerable to zip slip in project import

MEDIUM Published 2023-07-18 Modified 2025-06-10 Official page ↗
Aliases
CVE-2023-37476
Ecosystem
Maven
Packages
org.openrefine:main
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-22
Reviewed
2023-07-18

Affected packages

• Maven org.openrefine:main: < 3.7.4 → fixed in 3.7.4

Description

Impact A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it. Patches The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Workarounds Only import OpenRefine projects from trusted sources. References A similar issue existed in the Create Project feature (CVE-2018-19859), which was fixed by PR #1901.

Related

Alias · CVE (1)

  • CVE-2023-37476 OpenRefine is a free, open source tool for data processing. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References