Vulnerability Description
OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form `translations-$LANG.json`. But when doing so in versions prior to 3.8.3, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to read other JSON files on the file system. Version 3.8.3 addresses this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openrefine | Openrefine | < 3.8.3 |
Related Weaknesses (CWE)
References
- https://github.com/OpenRefine/OpenRefine/commit/24d084052dc55426fe460f2a17524fd1Patch
- https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qfwq-6jh6-8xx4Vendor Advisory
FAQ
What is CVE-2024-49760?
CVE-2024-49760 is a vulnerability with a CVSS score of 7.1 (HIGH). OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form...
How severe is CVE-2024-49760?
CVE-2024-49760 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-49760?
Check the references section above for vendor advisories and patch information. Affected products include: Openrefine Openrefine.