CVE-2024-47880

{"id": "CVE-2024-47880", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2024-10-24T21:15:12.750", "references": [{"url": "https://github.com/OpenRefine/OpenRefine/commit/8060477fa53842ebabf43b63e039745932fa629d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-79jv-5226-783f", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-348"}, {"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page that submits a form POST that contains embedded JavaScript code. This code would then be included in the response, along with an attacker-controlled `Content-Type` header, and so potentially executed in the victim's browser as if it was part of OpenRefine. The attacker-provided code can do anything the user can do, including deleting projects, retrieving database passwords, or executing arbitrary Jython or Closure expressions, if those extensions are also present. The attacker must know a valid project ID of a project that contains at least one row. Version 3.8.3 fixes the issue."}, {"lang": "es", "value": "OpenRefine es una herramienta gratuita de c\u00f3digo abierto para trabajar con datos desordenados. Antes de la versi\u00f3n 3.8.3, el comando `export-rows` se puede utilizar de forma que refleje parte de la solicitud textualmente, con un encabezado Content-Type tambi\u00e9n tomado de la solicitud. Un atacante podr\u00eda llevar a un usuario a una p\u00e1gina maliciosa que env\u00ede un POST de formulario que contenga c\u00f3digo JavaScript incrustado. Este c\u00f3digo se incluir\u00eda entonces en la respuesta, junto con un encabezado `Content-Type` controlado por el atacante, y por lo tanto potencialmente se ejecutar\u00eda en el navegador de la v\u00edctima como si fuera parte de OpenRefine. El c\u00f3digo proporcionado por el atacante puede hacer todo lo que el usuario puede hacer, incluyendo eliminar proyectos, recuperar contrase\u00f1as de bases de datos o ejecutar expresiones Jython o Closure arbitrarias, si esas extensiones tambi\u00e9n est\u00e1n presentes. El atacante debe conocer un ID de proyecto v\u00e1lido de un proyecto que contenga al menos una fila. La versi\u00f3n 3.8.3 corrige el problema."}], "lastModified": "2024-10-30T17:42:42.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openrefine:openrefine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B0F993E-8EB2-4CD2-8985-3DCD90F7EBBF", "versionEndExcluding": "3.8.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}