CVE-2024-49760 - CVE House
Back to Database
Status published High CVE-2024-49760

OpenRefine has a path traversal in LoadLanguageCommand

Vulnerability Description

OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form `translations-$LANG.json`. But when doing so in versions prior to 3.8.3, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to read other JSON files on the file system. Version 3.8.3 addresses this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-49760

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenRefine

View All →
CVE-2024-47883
Butterfly has path/URL confusion in resource handling leading to multiple weaknesses
Critical 9.1
CVE-2024-47882
OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project
Medium 5.9
CVE-2024-47881
OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)
High 8.1
CVE-2024-47880
OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand
High 8.1
CVE-2024-47879
OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)
High 7.6

Affected Vendor

Affected Software

OpenRefine
Vulnerable Versions:
< 3.8.3

Timeline

Official Publish: October 24th, 2024
Last Modified: October 25th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact