CVE-2024-47881

Description

OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the `database` extension, the "enable_load_extension" property can be set for the SQLite integration, enabling an attacker to load (local or remote) extension DLLs and so run arbitrary code on the server. The attacker needs to have network access to the OpenRefine instance. Version 3.8.3 fixes this issue.

Reserved 2024-10-04 | Published 2024-10-24 | Updated 2024-10-25 | Assigner GitHub_M

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

>= 3.4-beta, < 3.8.3
affected

References

github.com/...Refine/security/advisories/GHSA-87cf-j763-vvh8

github.com/...ommit/853a1d91662e7dc278a9a94a38be58de04494056

cve.org (CVE-2024-47881)

nvd.nist.gov (CVE-2024-47881)

Download JSON