CVE-2022-41401: SSRF
First published: Fri Aug 04 2023(Updated: )
OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Openrefine Openrefine | <=3.5.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-41401
- https://github.com/OpenRefine/OpenRefine/blob/30d6edb7b6586623bda09456c797c35983fb80ff/main/tests/server/src/com/google/refine/importing/ImportingUtilitiesTests.java#L180
- https://github.com/OpenRefine/OpenRefine/blob/cb55cdfdf6f9ca916839778dc847cce803688998/main/src/com/google/refine/importing/ImportingUtilities.java#L103
- https://github.com/ixSly/CVE-2022-41401
- https://github.com/OpenRefine/OpenRefine/commit/8cb2fec45dd90fda8ed9608c691f6bb8ed721cd2
- https://github.com/advisories/GHSA-q7mc-fc87-v7w7 (Advisory)
Frequently Asked Questions
What is CVE-2022-41401?
CVE-2022-41401 is a Server-Side Request Forgery (SSRF) vulnerability in OpenRefine <= v3.5.2.
What is the severity of CVE-2022-41401?
CVE-2022-41401 has a severity rating of medium (6.5).
How does CVE-2022-41401 affect OpenRefine?
CVE-2022-41401 allows unauthorized users to exploit OpenRefine, potentially leading to unauthorized access to internal resources and sensitive file disclosure.
How do I fix CVE-2022-41401?
To fix CVE-2022-41401, upgrade to OpenRefine version 3.6.0 or newer.
What is Server-Side Request Forgery (SSRF)?
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make requests from the server to other internal or external resources.
- collector/nvd-latest
- collector/github-advisory
- alias/GHSA-q7mc-fc87-v7w7
- alias/CVE-2022-41401
- collector/github-advisory-latest
- collector/nvd-api
- collector/nvd-index
- collector/nvd-cve
- agent/type
- agent/softwarecombine
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/tags
- agent/source
- package-manager/maven
- vendor/openrefine
- canonical/openrefine openrefine
- version/openrefine openrefine/3.5.2