CVE-2024-47879CWE-352CWE-94

OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

High · published October 24, 2024

CVSS v3.1
7.6
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code. The attacker must know a valid project ID of a project that contains at least one row, and the attacker must convince the victim to open a malicious webpage. Version 3.8.3 fixes the issue.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.0th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-10-24T20:17Z
EPSS history
Timeline
  • 24 OCT 20:17Z
    OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)
    cvelistv5