CVE-2023-41887

CriticalPublic PoC

Published: 15 September 2023

Published

15 September 2023

Modified

21 November 2024

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.5375 98.0th percentile

Risk Priority 52 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-41887 is a critical-severity SQL Injection (CWE-89) vulnerability in Openrefine Openrefine. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 2.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

OpenRefine is an open source data cleaning tool that was affected by a remote code execution vulnerability in versions prior to 3.7.5. The flaw, tracked as CVE-2023-41887 and assigned CWE-89, carries a CVSS 3.1 score of 9.8 and permits unauthenticated attackers to run arbitrary code on the server.

Any remote attacker without credentials can exploit the issue over the network to achieve full code execution, resulting in complete compromise of confidentiality, integrity, and availability on the affected host. The vulnerability stems from insufficient input validation that allows malicious payloads to be processed by the application.

The official advisory and patch in version 3.7.5 are documented in GitHub security advisory GHSA-p3r5-x3hr-gpg5 along with the corresponding commit 693fde606d4b5b78b16391c29d110389eb605511; administrators are advised to upgrade immediately to close the exposure.

EPSS for the CVE reached a peak of 0.6261 with a current value of 0.5375, indicating sustained and material exploitation interest after disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2023-2552

Vulnerability details

OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.