GHSA-q7mc-fc87-v7w7

OpenRefine Server-Side Request Forgery vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-41401

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.openrefine:main	< 3.6.0	3.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-41401 advisory
https://github.com/OpenRefine/OpenRefine/commit/8cb2fec45dd90fda8ed9608c691f6bb8ed721cd2 web
https://github.com/OpenRefine/OpenRefine package
https://github.com/OpenRefine/OpenRefine/blob/30d6edb7b6586623bda09456c797c35983fb80ff/main/tests/server/src/com/google/refine/importing/Imp… web
https://github.com/OpenRefine/OpenRefine/blob/cb55cdfdf6f9ca916839778dc847cce803688998/main/src/com/google/refine/importing/ImportingUtiliti… web
https://github.com/ixSly/CVE-2022-41401 web