CVE-2024-47878 - CVE House

Back to Database

Status published High CVE-2024-47878

Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)

8.1 CVSS

Vulnerability Description

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET parameter verbatim in a `<script>` tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing JavaScript code, which would then cause that code to be executed in the victim's browser as if it was part of OpenRefine. Version 3.8.3 fixes this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47878

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenRefine

View All →

OpenRefine has a path traversal in LoadLanguageCommand

Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project

OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)

OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand

Affected Vendor

OpenRefine

View all reports →

Affected Software

OpenRefine

Vulnerable Versions:

< 3.8.3

Timeline

Official Publish: October 24th, 2024

Last Modified: October 28th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement