{"id":"CVE-2023-41886","aliases":["DEBIAN-CVE-2023-41886","EUVD-2023-2577","GHSA-qqh2-wvmv-h72m","UBUNTU-CVE-2023-41886","USN-7260-1"],"status":"published","title":"OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00997,"percentile":0.63005,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2023-09-12T13:52:05Z","modified":"2026-10-28T10:38:59Z","fixes":[{"ecosystem":"Maven","package":"org.openrefine:database","fixed_in":["3.7.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"openrefine","fixed_in":["3.6.2-2+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openrefine","fixed_in":["3.7.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","fixed_in":["3.5.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openrefine","fixed_in":["3.7.7-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.openrefine:database","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.7.4"},{"fixed":"3.7.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-2+deb12u2"}]}],"versions":["3.6.2-2","3.6.2-2+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.openrefine:database","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5"}]}],"versions":["3.6-beta1","3.6-beta2","3.6-rc1","3.6.0","3.6.1","3.6.2","3.7-beta1","3.7-beta2","3.7.0","3.7.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-1ubuntu0.1~esm1"}]}],"versions":["3.5.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-1ubuntu0.1~esm1"}]}],"versions":["3.6.2-3","3.7.6-1","3.7.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-1ubuntu0.1~esm1"}]}],"versions":["3.5.2-1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-1ubuntu0.1~esm1"}]}],"versions":["3.6.2-3","3.7.6-1","3.7.7-1"],"bundled":10}],"products":[{"vendor":"openrefine","product":"openrefine"}],"references":[{"url":"https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qqh2-wvmv-h72m","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/OpenRefine/OpenRefine/commit/2de1439f5be63d9d0e89bbacbd24fa28c8c3e29d","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41886","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qqh2-wvmv-h72m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41886.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-41886","tags":["advisory"]},{"url":"https://github.com/OpenRefine/OpenRefine","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-41886","tags":["report"]},{"url":"https://github.com/OpenRefine/OpenRefine/commit/693fde606d4b5b78b16391c29d110389eb605511","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41886","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7260-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-37476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-41887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-23833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47882","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49760","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-41886","title":"OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.","status":"published","published":"2023-09-15T20:05:20.651Z","modified":"2024-09-25T18:48:19.859Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:35:19.217111Z"}],"euvd":[{"id":"EUVD-2023-2577","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.","status":"published","published":"2023-09-15T20:05:20Z","modified":"2024-09-25T18:48:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:28:12.011224Z"}],"ghsa":[{"id":"GHSA-qqh2-wvmv-h72m","title":"OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack","description":"### Summary\nAn arbitrary file read vulnerability allows any unauthenticated user to read the file on the server._\n\n### Details\nHi,Team,\ni find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker can read the file on the server.\nThere are some differences in utilization depending on the version of the mysql-connector dependency on the server side.  \n1.  mysql-connector-java version \u003e 8.14\nThe default value of `allowLoadLocalInfile` on the server side is false in this case.We need to manually set this value to true in the connection string.  \nSince the way to get the databaseurl in `com/google/refine/extension/database/mysql/MySQLConnectionManager.java` is to splice the individual configurations directly, we can set the `allowLoadLocalInfile` parameter after the other parameters(for example the `databaseName` parameter ).  \n![image](https://user-images.githubusercontent.com/24366795/262531956-ef8bb163-6692-4494-92f9-3b9bcffdf503.png)  \n![image](https://user-images.githubusercontent.com/24366795/262531716-95e7c9a6-601d-4157-bce9-c58d17a6e3ea.png)\n![image](https://user-images.githubusercontent.com/24366795/262531614-a34f891f-acd2-4354-bbbe-96447a9dcbd1.png)\n2.  mysql-connector-java version \u003c= 8.14\nThe default value of `allowLoadLocalInfile` on the server side is true in this case.so wo don't need do anything,Just connect to our malicious server.\n\n### PoC\nenv:   \ncentos 7\nopenrefine 3.7.4 \njdk11 \nmysql-connector-java version 8.30.0  \n\nyou can use the tool https://github.com/4ra1n/mysql-fake-server to running a malicious mysql server.  \n![image](https://user-images.githubusercontent.com/24366795/262536594-a62dbc2c-62d2-4b21-a351-5be7f506f852.png)  \nfor example,to read the /etc/passwd file.\n![image](https://user-images.githubusercontent.com/24366795/262539711-f274a396-9c0a-4ace-b3af-3b4e5309ab00.png)\nset the `username` to `base64ZmlsZXJlYWRfL2V0Yy9wYXNzd2Q=` and `Database name` to `test?allowLoadLocalInfile=true#` (for  mysql-connector-java version \u003c= 8.14,just setting the database name normally) and test to connect your malicious mysql server.\nyou can get the file in your fake-server-files directory.\n![image](https://user-images.githubusercontent.com/24366795/262542538-c9f501a4-899f-4b57-89b9-b8dd42f535fb.png)\n\n\n### Impact\n\nAn arbitrary file read vulnerability allows any unauthenticated user to read the file on the server._\n","status":"published","published":"2023-09-12T13:52:05Z","modified":"2023-11-11T05:01:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:20.311836Z"}],"nvd":[{"id":"CVE-2023-41886","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.","status":"published","published":"2023-09-15T21:15:11.297Z","modified":"2026-06-17T06:23:00.373Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"CVE-2023-41886","title":"OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.","status":"published","published":"2023-09-15T20:05:20.651Z","modified":"2026-11-11T02:47:32.839120479Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"DEBIAN-CVE-2023-41886","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.","status":"published","published":"2023-09-15T21:15:11.297Z","modified":"2026-10-26T18:03:06.257557127Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"GHSA-qqh2-wvmv-h72m","title":"OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack","description":"### Summary\nAn arbitrary file read vulnerability allows any unauthenticated user to read the file on the server._\n\n### Details\nHi,Team,\ni find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker can read the file on the server.\nThere are some differences in utilization depending on the version of the mysql-connector dependency on the server side.  \n1.  mysql-connector-java version \u003e 8.14\nThe default value of `allowLoadLocalInfile` on the server side is false in this case.We need to manually set this value to true in the connection string.  \nSince the way to get the databaseurl in `com/google/refine/extension/database/mysql/MySQLConnectionManager.java` is to splice the individual configurations directly, we can set the `allowLoadLocalInfile` parameter after the other parameters(for example the `databaseName` parameter ).  \n![image](https://user-images.githubusercontent.com/24366795/262531956-ef8bb163-6692-4494-92f9-3b9bcffdf503.png)  \n![image](https://user-images.githubusercontent.com/24366795/262531716-95e7c9a6-601d-4157-bce9-c58d17a6e3ea.png)\n![image](https://user-images.githubusercontent.com/24366795/262531614-a34f891f-acd2-4354-bbbe-96447a9dcbd1.png)\n2.  mysql-connector-java version \u003c= 8.14\nThe default value of `allowLoadLocalInfile` on the server side is true in this case.so wo don't need do anything,Just connect to our malicious server.\n\n### PoC\nenv:   \ncentos 7\nopenrefine 3.7.4 \njdk11 \nmysql-connector-java version 8.30.0  \n\nyou can use the tool https://github.com/4ra1n/mysql-fake-server to running a malicious mysql server.  \n![image](https://user-images.githubusercontent.com/24366795/262536594-a62dbc2c-62d2-4b21-a351-5be7f506f852.png)  \nfor example,to read the /etc/passwd file.\n![image](https://user-images.githubusercontent.com/24366795/262539711-f274a396-9c0a-4ace-b3af-3b4e5309ab00.png)\nset the `username` to `base64ZmlsZXJlYWRfL2V0Yy9wYXNzd2Q=` and `Database name` to `test?allowLoadLocalInfile=true#` (for  mysql-connector-java version \u003c= 8.14,just setting the database name normally) and test to connect your malicious mysql server.\nyou can get the file in your fake-server-files directory.\n![image](https://user-images.githubusercontent.com/24366795/262542538-c9f501a4-899f-4b57-89b9-b8dd42f535fb.png)\n\n\n### Impact\n\nAn arbitrary file read vulnerability allows any unauthenticated user to read the file on the server._\n","status":"published","published":"2023-09-12T13:52:05Z","modified":"2026-09-10T03:50:03.255498805Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"UBUNTU-CVE-2023-41886","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.","status":"published","published":"2023-09-15T21:15:00Z","modified":"2026-02-04T03:22:12.9503Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"USN-7260-1","title":"openrefine vulnerabilities","description":"It was discovered that OpenRefine did not properly handle opening tar\nfiles. If a user or application were tricked into opening a crafted tar\nfile, an attacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 22.04 LTS. (CVE-2023-37476)\n\nIt was discovered that OpenRefine incorrectly handled file permissions and\nuser authentication. An unauthenticated attacker could possibly use this\nissue to leak sensitive information or execute arbitrary code. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2023-41886, CVE-2023-41887)\n\nIt was discovered that OpenRefine did not properly disallow database\nsettings to be modified when queried. An attacker could possibly use this\nissue to leak sensitive information. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-23833)\n\nIt was discovered that OpenRefine did not properly sanitize the GET\nparameter for authorized commands, leading to a cross site scripting\nvulnerability. An attacker could possibly use this issue to execute\narbitrary code. (CVE-2024-47878)\n\nIt was discovered that OpenRefine did not properly prevent cross-site\nrequest forgery when running the preview-expression command. If a user or\napplication were tricked into opening a specially crafted webpage, an\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-47879)\n\nIt was discovered that OpenRefine did not properly handle HTTP headers.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-47880)\n\nIt was discovered that OpenRefine incorrectly handled database extensions.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-47881)\n\nIt was discovered that OpenRefine did not properly escape HTML tags in\nexception messages, which could enable code injection. If a user or\napplication were tricked into opening a malicious file, an attacker could\nuse this issue to execute arbitrary code. (CVE-2024-47882)\n\nIt was discovered that OpenRefine did not correctly handle paths when\nexecuting the load-language command. An attacker could possibly use this\nissue to leak sensitive information. (CVE-2024-49760)\n","status":"published","published":"2025-02-10T03:32:44Z","modified":"2026-04-27T17:43:15.654565Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}