The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://github.com/OpenRefine/OpenRefine/issues/1907 |
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2018-12-14T23:00:00
Updated: 2024-08-05T11:51:19.259Z
Reserved: 2018-12-14T00:00:00
Link: CVE-2018-20157
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2018-12-15T00:29:00.317
Modified: 2019-01-03T20:10:48.413
Link: CVE-2018-20157
Redhat
No data.