{"id":"CVE-2022-41401","aliases":["DEBIAN-CVE-2022-41401","EUVD-2023-2337","GHSA-q7mc-fc87-v7w7","UBUNTU-CVE-2022-41401"],"status":"published","title":"OpenRefine Server-Side Request Forgery vulnerability","description":"OpenRefine \u003c= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01384,"percentile":0.72391,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-918"],"published":"2023-08-04T00:00:00Z","modified":"2026-10-28T02:30:23Z","exploits":[{"source":"pocgithub","id":"ixSly/CVE-2022-41401","title":"ixSly/CVE-2022-41401","date":"2023-07-31","url":"https://github.com/ixSly/CVE-2022-41401"}],"fixes":[{"ecosystem":"Maven","package":"org.openrefine:main","fixed_in":["3.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"openrefine","fixed_in":["3.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openrefine","fixed_in":["3.6.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.openrefine:main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.openrefine:main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0"}]}],"versions":["3.6-beta1","3.6-beta2","3.6-rc1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.2-1","3.5.2-1ubuntu0.1~esm1"]}],"products":[{"vendor":"openrefine","product":"openrefine"}],"references":[{"url":"https://github.com/OpenRefine/OpenRefine/blob/30d6edb7b6586623bda09456c797c35983fb80ff/main/tests/server/src/com/google/refine/importing/ImportingUtilitiesTests.java#L180","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://github.com/OpenRefine/OpenRefine/blob/cb55cdfdf6f9ca916839778dc847cce803688998/main/src/com/google/refine/importing/ImportingUtilities.java#L103","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://github.com/ixSly/CVE-2022-41401","tags":["x_transferred","Exploit","package","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41401","tags":["advisory"]},{"url":"https://github.com/OpenRefine/OpenRefine/commit/8cb2fec45dd90fda8ed9608c691f6bb8ed721cd2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q7mc-fc87-v7w7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41401.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-41401","tags":["advisory"]},{"url":"https://github.com/OpenRefine/OpenRefine","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-41401","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41401","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-41401","description":"OpenRefine \u003c= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.","status":"published","published":"2023-08-04T00:00:00Z","modified":"2024-10-17T15:42:26.366Z","updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2023-2337","description":"OpenRefine \u003c= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.","status":"published","published":"2023-08-04T00:00:00Z","modified":"2024-10-17T15:42:26Z","updated_at":"2026-11-03T00:27:34.339903Z"}],"ghsa":[{"id":"GHSA-q7mc-fc87-v7w7","title":"OpenRefine Server-Side Request Forgery vulnerability","description":"OpenRefine \u003c= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.","status":"published","published":"2023-08-04T18:30:39Z","modified":"2023-11-10T05:01:36Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:37:18.40412Z"}],"nvd":[{"id":"CVE-2022-41401","description":"OpenRefine \u003c= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.","status":"published","published":"2023-08-04T17:15:09.583Z","modified":"2026-06-17T05:03:08.637Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:07:38.721429Z"}],"osv":[{"id":"DEBIAN-CVE-2022-41401","description":"OpenRefine \u003c= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.","status":"published","published":"2023-08-04T17:15:09.583Z","modified":"2026-11-03T08:03:13.190952686Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-q7mc-fc87-v7w7","title":"OpenRefine Server-Side Request Forgery vulnerability","description":"OpenRefine \u003c= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.","status":"published","published":"2023-08-04T18:30:39Z","modified":"2024-02-16T08:13:33.069738Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"UBUNTU-CVE-2022-41401","description":"OpenRefine \u003c= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.","status":"published","published":"2023-08-04T17:15:00Z","modified":"2025-10-24T04:53:52Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"CVE-2022-41401","description":"OpenRefine \u003c= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.","status":"published","published":"2023-08-04T00:00:00Z","modified":"2026-10-28T02:30:23.18391834Z","updated_at":"2026-11-02T15:44:26.860704Z"}]}}