Read the docs
TI-2024-15827 Aliases CVE-2024-23833GHSA-6p92-qfqf-qwx4

OpenRefine JDBC Attack Vulnerability

Priority MEDIUM 41CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22, CWE-863 and the CVSS impact.

Summary

OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest version of OpenRefine (8.0.30), there is no associated deserialization utilization point, so original code execution cannot be achieved, but attackers can use this vulnerability to read sensitive files on the target server. This issue has been addressed in version 3.7.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00999 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed OpenRefine (OpenRefine): 3.7.8org.openrefine:database (Maven): 3.7.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenRefineOpenRefinebefore 3.7.83.7.8Patch availableCNA
—org.openrefine:database (Maven)before 3.7.83.7.8Patch availableGHSA-6p92-qfqf-qwx4
  • OpenRefine VendorOpenRefine Affected before 3.7.8 Fixed in 3.7.8 Patch available CNA
  • org.openrefine:database (Maven) Vendor— Affected before 3.7.8 Fixed in 3.7.8 Patch available GHSA-6p92-qfqf-qwx4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openrefine:openrefine:*:*:*:*:*:*:*:*before 3.7.8VulnerableOpenRefine
  • cpe:2.3:a:openrefine:openrefine:*:*:*:*:*:*:*:* Versions before 3.7.8 Vulnerable ·OpenRefine

Remediation

  • Fix · CNA OpenRefine (OpenRefine) Fixed in 3.7.8
  • Fix · GHSA-6p92-qfqf-qwx4 org.openrefine:database (Maven) Fixed in 3.7.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23833
  2. 2026-10-03 Alias added: GHSA-6p92-qfqf-qwx4

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2023-22279 Remote Code exec in project import with mysql jdbc url attack CVSS 3.1CRITICAL 9.8
  • TI-2024-32135 OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE) CVSS 3.1HIGH 8.8
  • TI-2024-32133 OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2023-22278 OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack CVSS 3.1HIGH 7.5
  • TI-2024-32134 OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand CVSS 3.1HIGH 8.1
  • TI-2024-32132 Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt) CVSS 3.1HIGH 8.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences