We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-47879

OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)



Description

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code. The attacker must know a valid project ID of a project that contains at least one row, and the attacker must convince the victim to open a malicious webpage. Version 3.8.3 fixes the issue.

Reserved 2024-10-04 | Published 2024-10-24 | Updated 2024-10-25 | Assigner GitHub_M


HIGH: 7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Problem types

CWE-352: Cross-Site Request Forgery (CSRF)

CWE-94: Improper Control of Generation of Code ('Code Injection')

Product status

< 3.8.3
affected

References

github.com/...Refine/security/advisories/GHSA-3jm4-c6qf-jrh3

github.com/...ommit/090924ca923489b6c94397cf1f5df7f7f78f0126

cve.org (CVE-2024-47879)

nvd.nist.gov (CVE-2024-47879)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2024-47879

Support options

Helpdesk Chat, Email, Knowledgebase