Description

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET parameter verbatim in a `<script>` tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing JavaScript code, which would then cause that code to be executed in the victim's browser as if it was part of OpenRefine. Version 3.8.3 fixes this issue.

INFO

Published Date :

2024-10-24T20:11:19.814Z

Last Modified :

2024-10-28T13:00:42.860Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-47878 vulnerability.

Vendors Products
Openrefine
  • Openrefine
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-47878.

URL Resource
https://github.com/OpenRefine/OpenRefine/commit/10bf0874d67f1018a58b3732332d76b840192fea cve-icon cve-icon
https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-pw3x-c5vp-mfc3 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact