{"id":"CVE-2023-41887","aliases":["DEBIAN-CVE-2023-41887","EUVD-2023-2552","GHSA-p3r5-x3hr-gpg5","UBUNTU-CVE-2023-41887","USN-7260-1"],"status":"published","title":"Remote Code exec in project import with mysql jdbc url attack","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.4254,"percentile":0.98717,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2023-09-12T13:52:54Z","modified":"2026-10-28T10:38:59Z","fixes":[{"ecosystem":"Maven","package":"org.openrefine:database","fixed_in":["3.7.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"openrefine","fixed_in":["3.6.2-2+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openrefine","fixed_in":["3.7.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","fixed_in":["3.5.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openrefine","fixed_in":["3.7.7-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.openrefine:database","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.7.4"},{"fixed":"3.7.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-2+deb12u2"}]}],"versions":["3.6.2-2","3.6.2-2+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.openrefine:database","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5"}]}],"versions":["3.6-beta1","3.6-beta2","3.6-rc1","3.6.0","3.6.1","3.6.2","3.7-beta1","3.7-beta2","3.7.0","3.7.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-1ubuntu0.1~esm1"}]}],"versions":["3.5.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-1ubuntu0.1~esm1"}]}],"versions":["3.6.2-3","3.7.6-1","3.7.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-1ubuntu0.1~esm1"}]}],"versions":["3.5.2-1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-1ubuntu0.1~esm1"}]}],"versions":["3.6.2-3","3.7.6-1","3.7.7-1"],"bundled":10}],"products":[{"vendor":"openrefine","product":"openrefine"}],"references":[{"url":"https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-p3r5-x3hr-gpg5","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/OpenRefine/OpenRefine/commit/693fde606d4b5b78b16391c29d110389eb605511","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41887","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p3r5-x3hr-gpg5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41887.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-41887","tags":["advisory"]},{"url":"https://github.com/OpenRefine/OpenRefine","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-41887","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41887","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7260-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-37476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-41886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-23833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47882","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49760","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-41887","title":"Remote Code exec in project import with mysql jdbc url attack","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.","status":"published","published":"2023-09-15T20:06:55.728Z","modified":"2024-09-25T18:55:03.906Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:35:18.88314Z"}],"euvd":[{"id":"EUVD-2023-2552","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.","status":"published","published":"2023-09-15T20:06:55Z","modified":"2024-09-25T18:55:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:28:12.011224Z"}],"ghsa":[{"id":"GHSA-p3r5-x3hr-gpg5","title":"OpenRefine Remote Code execution in project import with mysql jdbc url attack","description":"### Summary\nAn remote Code exec vulnerability allows any unauthenticated user to exec code on the server.\n\n### Details\nHi,Team,\ni find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker can get rce on the server through the mysql userializable If the mysql-connector-java version used on the server side is less than 8.20.\nIn order for the server to enable deserialization we need to set the `autoDeserialize` and `queryInterceptors` parameters in the connection string,As same with https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qqh2-wvmv-h72m, since the concatenation string is a direct concatenation, it is possible to inject the required parameters after the other parameters.\n![image](https://user-images.githubusercontent.com/24366795/262581108-e98dfe16-ee67-463f-8c49-7c318bf0d6f3.png)\n\nAnd there is a commons-beanutils dependency library on the server side, which contains an RCE-capable deserialization exploit chain\n\n### PoC\nenv:\ncentos 7\nopenrefine 3.7.4\njdk11\nmysql-connector-java version 8.14.0\nyou can use the tool https://github.com/4ra1n/mysql-fake-server to running a malicious mysql server.    \nfor example use the CB 1.9 Gadget to exec command `touch /tmp/hacked`.  \n![image](https://user-images.githubusercontent.com/24366795/262583287-7351a00a-32bf-4cb3-8d86-65ff0a112360.png)  \nset the `user` to `base64ZGVzZXJfQ0JfdG91Y2ggL3RtcC9oYWNrZWQ=`(`touch /tmp/hacked` base64 encode),`dataBaseName` to `test?autoDeserialize=true\u0026queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor#`.  \n![image](https://user-images.githubusercontent.com/24366795/262583657-9cfb9caa-02ed-4f6b-b110-650108803172.png)\n![image](https://user-images.githubusercontent.com/24366795/262583815-a17d5530-bae8-4b4f-9392-4ea41b328c7d.png)  \n command `touch /tmp/hacked` is executed.  \n![image](https://user-images.githubusercontent.com/24366795/262583979-823d5843-578f-4af6-b84f-a1422aa1b863.png)\n\n### Impact\nAn remote Code exec vulnerability allows any unauthenticated user to exec code on the server.","status":"published","published":"2023-09-12T13:52:54Z","modified":"2023-11-11T05:01:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:19.438667Z"}],"nvd":[{"id":"CVE-2023-41887","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.","status":"published","published":"2023-09-15T21:15:11.407Z","modified":"2026-06-17T06:23:00.497Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"CVE-2023-41887","title":"Remote Code exec in project import with mysql jdbc url attack","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.","status":"published","published":"2023-09-15T20:06:55.728Z","modified":"2026-10-28T10:38:59.829370548Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DEBIAN-CVE-2023-41887","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.","status":"published","published":"2023-09-15T21:15:11.407Z","modified":"2026-10-26T18:02:32.667453207Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"GHSA-p3r5-x3hr-gpg5","title":"OpenRefine Remote Code execution in project import with mysql jdbc url attack","description":"### Summary\nAn remote Code exec vulnerability allows any unauthenticated user to exec code on the server.\n\n### Details\nHi,Team,\ni find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker can get rce on the server through the mysql userializable If the mysql-connector-java version used on the server side is less than 8.20.\nIn order for the server to enable deserialization we need to set the `autoDeserialize` and `queryInterceptors` parameters in the connection string,As same with https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qqh2-wvmv-h72m, since the concatenation string is a direct concatenation, it is possible to inject the required parameters after the other parameters.\n![image](https://user-images.githubusercontent.com/24366795/262581108-e98dfe16-ee67-463f-8c49-7c318bf0d6f3.png)\n\nAnd there is a commons-beanutils dependency library on the server side, which contains an RCE-capable deserialization exploit chain\n\n### PoC\nenv:\ncentos 7\nopenrefine 3.7.4\njdk11\nmysql-connector-java version 8.14.0\nyou can use the tool https://github.com/4ra1n/mysql-fake-server to running a malicious mysql server.    \nfor example use the CB 1.9 Gadget to exec command `touch /tmp/hacked`.  \n![image](https://user-images.githubusercontent.com/24366795/262583287-7351a00a-32bf-4cb3-8d86-65ff0a112360.png)  \nset the `user` to `base64ZGVzZXJfQ0JfdG91Y2ggL3RtcC9oYWNrZWQ=`(`touch /tmp/hacked` base64 encode),`dataBaseName` to `test?autoDeserialize=true\u0026queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor#`.  \n![image](https://user-images.githubusercontent.com/24366795/262583657-9cfb9caa-02ed-4f6b-b110-650108803172.png)\n![image](https://user-images.githubusercontent.com/24366795/262583815-a17d5530-bae8-4b4f-9392-4ea41b328c7d.png)  \n command `touch /tmp/hacked` is executed.  \n![image](https://user-images.githubusercontent.com/24366795/262583979-823d5843-578f-4af6-b84f-a1422aa1b863.png)\n\n### Impact\nAn remote Code exec vulnerability allows any unauthenticated user to exec code on the server.","status":"published","published":"2023-09-12T13:52:54Z","modified":"2026-09-10T03:49:58.294732402Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"UBUNTU-CVE-2023-41887","description":"OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.","status":"published","published":"2023-09-15T21:15:00Z","modified":"2026-02-04T02:17:19.90002Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"USN-7260-1","title":"openrefine vulnerabilities","description":"It was discovered that OpenRefine did not properly handle opening tar\nfiles. If a user or application were tricked into opening a crafted tar\nfile, an attacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 22.04 LTS. (CVE-2023-37476)\n\nIt was discovered that OpenRefine incorrectly handled file permissions and\nuser authentication. An unauthenticated attacker could possibly use this\nissue to leak sensitive information or execute arbitrary code. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2023-41886, CVE-2023-41887)\n\nIt was discovered that OpenRefine did not properly disallow database\nsettings to be modified when queried. An attacker could possibly use this\nissue to leak sensitive information. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-23833)\n\nIt was discovered that OpenRefine did not properly sanitize the GET\nparameter for authorized commands, leading to a cross site scripting\nvulnerability. An attacker could possibly use this issue to execute\narbitrary code. (CVE-2024-47878)\n\nIt was discovered that OpenRefine did not properly prevent cross-site\nrequest forgery when running the preview-expression command. If a user or\napplication were tricked into opening a specially crafted webpage, an\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-47879)\n\nIt was discovered that OpenRefine did not properly handle HTTP headers.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-47880)\n\nIt was discovered that OpenRefine incorrectly handled database extensions.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-47881)\n\nIt was discovered that OpenRefine did not properly escape HTML tags in\nexception messages, which could enable code injection. If a user or\napplication were tricked into opening a malicious file, an attacker could\nuse this issue to execute arbitrary code. (CVE-2024-47882)\n\nIt was discovered that OpenRefine did not correctly handle paths when\nexecuting the load-language command. An attacker could possibly use this\nissue to leak sensitive information. (CVE-2024-49760)\n","status":"published","published":"2025-02-10T03:32:44Z","modified":"2026-04-27T17:43:15.654565Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}