CVE-2018-20157: XEE
Published Dec 14, 2018
·Updated
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
Affected Software
1 affected component
OpenRefine openrefine<=3.1
Remediation
Patch Available
Event History
Dec 14, 2018
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this OpenRefine vulnerability?
The vulnerability ID of this OpenRefine vulnerability is CVE-2018-20157.
2
What is the severity of CVE-2018-20157?
The severity of CVE-2018-20157 is high with a CVSS score of 7.5.
3
How does the vulnerability in OpenRefine through 3.1 allow an attacker to read arbitrary files?
The vulnerability in OpenRefine through 3.1 allows an attacker to read arbitrary files through a crafted (zip) file by exploiting an XML External Entity (XXE) attack.
4
Which software version is affected by CVE-2018-20157?
The software version affected by CVE-2018-20157 is OpenRefine up to and including version 3.1.
5
Is there any fix available for CVE-2018-20157?
Yes, a fix is available for CVE-2018-20157. It is recommended to update OpenRefine to a version that is not affected by the vulnerability.