← Vulnerability feed

Vulnerability record · CVE-2024-23833 · published 12 February 2024

CVE-2024-23833: Openrefine path traversal vulnerability

Openrefine · Openrefine

OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest version of OpenRefine (8.0.30), there is no associated deserialization utilization point, so original code execution cannot be achieved, but attackers can use this vulnerability to read sensitive files on the target server. This issue has been addressed in version 3.7.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

7.5 CVSS 3.1 High EPSS 1.00% · top 38.7% CWE-22 · Path traversalCWE-863 · Incorrect authorization
7.5CVSS 3.1 base score
1.00%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest version of OpenRefine (8.0.30), there is no associated deserialization utilization point, so original code execution cannot be achieved, but attackers can use this vulnerability to read sensitive files on the target server. This issue has been addressed in version 3.7.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/OpenRefine/OpenRefine/commit/41ccf574847d856e22488a7c0987ad8efa12a84a Patch
https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-6p92-qfqf-qwx4 ExploitVendor Advisory
https://github.com/OpenRefine/OpenRefine/commit/41ccf574847d856e22488a7c0987ad8efa12a84a Patch
https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-6p92-qfqf-qwx4 ExploitVendor Advisory

Track CVE-2024-23833 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-41887Openrefine sql injection vulnerabilityOpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any…EPSS 43%8.8CVE-2024-47879Openrefine code injection vulnerabilityOpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `pre…EPSS 0.40%8.8CVE-2024-47881Openrefine sql injection vulnerabilityOpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the `database` extens…EPSS 0.65%7.8CVE-2023-37476Openrefine path traversal vulnerabilityOpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrar…EPSS 0.63%7.5CVE-2023-41886Openrefine sql injection vulnerabilityOpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any …EPSS 1.00%7.5CVE-2019-3580Openrefine path traversal vulnerabilityOpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file.EPSS 1.9%7.5CVE-2018-20157Openrefine xml external entity (xxe) vulnerabilityThe data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers t…EPSS 1.7%6.9CVE-2024-47880Openrefine cross-site scripting vulnerabilityOpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a way that …EPSS 0.36%

Source: NIST National Vulnerability Database (record CVE-2024-23833), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.