org.openrefine/database vulnerabilities

Latest org.openrefine/database CVEs

Newest publication first

1. CVE-2024-47881 OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)

   Published 2024-10-24

   High·CVSS 8.8 EPSS 0.69%

   OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the database extension, the "enable_load_extension" property can be set for the SQLite integration, enabling an attacker to load (local or remote) exten...

2. CVE-2024-23833 OpenRefine JDBC Attack Vulnerability

   Published 2024-02-12

   High·CVSS 7.5 EPSS 1.00%

   OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver libr...

3. CVE-2023-41887 Remote Code exec in project import with mysql jdbc url attack

   Published 2023-09-15

   Critical·CVSS 9.8 EPSS 42.5%

   OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.

4. CVE-2023-41886 OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack

   Published 2023-09-15

   High·CVSS 7.5 EPSS 1.00%

   OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.