CVE-2024-47878: OpenRefine has a reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)

October 24, 2024 (updated October 30, 2024)

The /extension/gdata/authorized endpoint includes the state GET parameter verbatim in a <script> tag in the output, so without escaping.

An attacker could lead or redirect a user to a crafted URL containing JavaScript code, which would then cause that code to be executed in the victim’s browser as if it was part of OpenRefine.

References

github.com/OpenRefine/OpenRefine
github.com/OpenRefine/OpenRefine/commit/10bf0874d67f1018a58b3732332d76b840192fea
github.com/OpenRefine/OpenRefine/security/advisories/GHSA-pw3x-c5vp-mfc3
github.com/advisories/GHSA-pw3x-c5vp-mfc3
nvd.nist.gov/vuln/detail/CVE-2024-47878

Code Behaviors & Features

Detect and mitigate CVE-2024-47878 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →