{"id":"CVE-2024-47882","aliases":["DEBIAN-CVE-2024-47882","EUVD-2024-3067","GHSA-j8hp-f2mj-586g","UBUNTU-CVE-2024-47882","USN-7260-1"],"status":"published","title":"OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project","description":"OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in \"Something went wrong!\" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult.  However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0051,"percentile":0.43848,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-81"],"published":"2024-10-24T18:13:04Z","modified":"2026-11-02T12:02:52Z","fixes":[{"ecosystem":"Maven","package":"org.openrefine:openrefine","fixed_in":["3.8.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"openrefine","fixed_in":["3.6.2-2+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openrefine","fixed_in":["3.8.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","fixed_in":["3.5.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openrefine","fixed_in":["3.7.7-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.openrefine:openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-2+deb12u3"}]}],"versions":["3.6.2-2","3.6.2-2+deb12u1","3.6.2-2+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.7-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.openrefine:openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3"}]}],"versions":["3.6-beta1","3.6-beta2","3.6-rc1","3.6.0","3.6.1","3.6.2","3.7-beta1","3.7-beta2","3.7.0","3.7.2","3.8-beta1","3.8-beta5","3.8.0","3.8.1","3.8.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-1ubuntu0.1~esm1"}]}],"versions":["3.5.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-1ubuntu0.1~esm1"}]}],"versions":["3.6.2-3","3.7.6-1","3.7.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-1ubuntu0.1~esm1"}]}],"versions":["3.5.2-1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openrefine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-1ubuntu0.1~esm1"}]}],"versions":["3.6.2-3","3.7.6-1","3.7.7-1"],"bundled":10}],"products":[{"vendor":"openrefine","product":"openrefine"}],"references":[{"url":"https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-j8hp-f2mj-586g","tags":["x_refsource_CONFIRM","Exploit","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/OpenRefine/OpenRefine/commit/85594e75e7b36025f7b6a67dcd3ec253c5dff8c2","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/OpenRefine/OpenRefine/blob/master/main/webapp/modules/core/error.vt#L52-L53","tags":["x_refsource_MISC","Product","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47882","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j8hp-f2mj-586g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47882.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-47882","tags":["advisory"]},{"url":"https://github.com/OpenRefine/OpenRefine","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-47882","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47882","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7260-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-37476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-41886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-41887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-23833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49760","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-47882","title":"OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project","description":"OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in \"Something went wrong!\" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult.  However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue.","status":"published","published":"2024-10-24T20:35:30.254Z","modified":"2024-10-25T19:25:18.385Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79","CWE-81"],"updated_at":"2026-11-02T14:33:57.638551Z"}],"euvd":[{"id":"EUVD-2024-3067","description":"OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in \"Something went wrong!\" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult.  However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue.","status":"published","published":"2024-10-24T20:35:30Z","modified":"2024-10-25T19:25:18Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:17.135828Z"}],"ghsa":[{"id":"GHSA-j8hp-f2mj-586g","title":"OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project","description":"### Summary\n\nThe built-in \"Something went wrong!\" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message.\n\nIt appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, as in GHSA-m88m-crr9-jvqq, which may be difficult.  However, out-of-tree extensions may add their own calls to `respondWithErrorPage`.\n\n### Details\n\nThe `Command.respondWithErrorPage` (through `HttpUtilities.respondWithErrorPage`) function renders the Velocity template `error.vt`, which contains the `$message` and `$stack` variables, which are included in the response as-is:\n\nhttps://github.com/OpenRefine/OpenRefine/blob/master/main/webapp/modules/core/error.vt#L52-L53\n\nHowever, the message can contain HTML tags, which would then be interpreted by the browser. A mitigation would be to escape both the message and stack trace, perhaps using Guava's HTML escaper.\n\nFlows that report errors as `application/json` responses are not interpreted by the browser and so not affected by this issue.\n\n### PoC\n\nIn OpenRefine, use the \"Import project\" feature to import the following URL (or upload it as a file): https://wandernauta.nl/oa/example.tar.gz\n\nA JavaScript alert appears.\n\n### Impact\n\nExecution of arbitrary JavaScript in the victim's browser, provided the victim can be convinced to import a malicious project. The script can do anything the user can do.","status":"published","published":"2024-10-24T18:13:04Z","modified":"2024-10-24T21:46:04Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-79","CWE-81"],"updated_at":"2026-11-02T14:38:13.09489Z"}],"nvd":[{"id":"CVE-2024-47882","description":"OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in \"Something went wrong!\" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult.  However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue.","status":"published","published":"2024-10-24T21:15:13.16Z","modified":"2026-06-17T07:57:54.737Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79","CWE-81"],"updated_at":"2026-11-02T14:10:34.877798Z"}],"osv":[{"id":"CVE-2024-47882","title":"OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project","description":"OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in \"Something went wrong!\" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult.  However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue.","status":"published","published":"2024-10-24T20:35:30.254Z","modified":"2026-10-28T10:54:32.118536717Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-79","CWE-81"],"updated_at":"2026-11-02T15:44:43.253252Z"},{"id":"DEBIAN-CVE-2024-47882","description":"OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in \"Something went wrong!\" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult.  However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue.","status":"published","published":"2024-10-24T21:15:13.16Z","modified":"2026-11-02T12:02:52.307956205Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"GHSA-j8hp-f2mj-586g","title":"OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project","description":"### Summary\n\nThe built-in \"Something went wrong!\" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message.\n\nIt appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, as in GHSA-m88m-crr9-jvqq, which may be difficult.  However, out-of-tree extensions may add their own calls to `respondWithErrorPage`.\n\n### Details\n\nThe `Command.respondWithErrorPage` (through `HttpUtilities.respondWithErrorPage`) function renders the Velocity template `error.vt`, which contains the `$message` and `$stack` variables, which are included in the response as-is:\n\nhttps://github.com/OpenRefine/OpenRefine/blob/master/main/webapp/modules/core/error.vt#L52-L53\n\nHowever, the message can contain HTML tags, which would then be interpreted by the browser. A mitigation would be to escape both the message and stack trace, perhaps using Guava's HTML escaper.\n\nFlows that report errors as `application/json` responses are not interpreted by the browser and so not affected by this issue.\n\n### PoC\n\nIn OpenRefine, use the \"Import project\" feature to import the following URL (or upload it as a file): https://wandernauta.nl/oa/example.tar.gz\n\nA JavaScript alert appears.\n\n### Impact\n\nExecution of arbitrary JavaScript in the victim's browser, provided the victim can be convinced to import a malicious project. The script can do anything the user can do.","status":"published","published":"2024-10-24T18:13:04Z","modified":"2024-10-24T22:39:42.380349Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-79","CWE-81"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"UBUNTU-CVE-2024-47882","description":"OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in \"Something went wrong!\" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult.  However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue.","status":"published","published":"2024-10-24T21:15:00Z","modified":"2026-02-04T04:29:17.668969Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"USN-7260-1","title":"openrefine vulnerabilities","description":"It was discovered that OpenRefine did not properly handle opening tar\nfiles. If a user or application were tricked into opening a crafted tar\nfile, an attacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 22.04 LTS. (CVE-2023-37476)\n\nIt was discovered that OpenRefine incorrectly handled file permissions and\nuser authentication. An unauthenticated attacker could possibly use this\nissue to leak sensitive information or execute arbitrary code. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2023-41886, CVE-2023-41887)\n\nIt was discovered that OpenRefine did not properly disallow database\nsettings to be modified when queried. An attacker could possibly use this\nissue to leak sensitive information. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-23833)\n\nIt was discovered that OpenRefine did not properly sanitize the GET\nparameter for authorized commands, leading to a cross site scripting\nvulnerability. An attacker could possibly use this issue to execute\narbitrary code. (CVE-2024-47878)\n\nIt was discovered that OpenRefine did not properly prevent cross-site\nrequest forgery when running the preview-expression command. If a user or\napplication were tricked into opening a specially crafted webpage, an\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-47879)\n\nIt was discovered that OpenRefine did not properly handle HTTP headers.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-47880)\n\nIt was discovered that OpenRefine incorrectly handled database extensions.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-47881)\n\nIt was discovered that OpenRefine did not properly escape HTML tags in\nexception messages, which could enable code injection. If a user or\napplication were tricked into opening a malicious file, an attacker could\nuse this issue to execute arbitrary code. (CVE-2024-47882)\n\nIt was discovered that OpenRefine did not correctly handle paths when\nexecuting the load-language command. An attacker could possibly use this\nissue to leak sensitive information. (CVE-2024-49760)\n","status":"published","published":"2025-02-10T03:32:44Z","modified":"2026-04-27T17:43:15.654565Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}