CVE-2024-23833 - CVE House
Back to Database
Status published High CVE-2024-23833

OpenRefine JDBC Attack Vulnerability

Vulnerability Description

OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest version of OpenRefine (8.0.30), there is no associated deserialization utilization point, so original code execution cannot be achieved, but attackers can use this vulnerability to read sensitive files on the target server. This issue has been addressed in version 3.7.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-23833

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenRefine

View All →
CVE-2024-49760
OpenRefine has a path traversal in LoadLanguageCommand
High 7.1
CVE-2024-47883
Butterfly has path/URL confusion in resource handling leading to multiple weaknesses
Critical 9.1
CVE-2024-47882
OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project
Medium 5.9
CVE-2024-47881
OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)
High 8.1
CVE-2024-47880
OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand
High 8.1

Affected Vendor

Affected Software

OpenRefine
Vulnerable Versions:
< 3.7.8

Timeline

Official Publish: February 12th, 2024
Last Modified: May 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact