Publish GHSA-qfwq-6jh6-8xx4

advisories/github-reviewed/2024/10/GHSA-qfwq-6jh6-8xx4/GHSA-qfwq-6jh6-8xx4.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qfwq-6jh6-8xx4",
+  "modified": "2024-10-24T18:32:40Z",
+  "published": "2024-10-24T18:32:40Z",
+  "aliases": [
+    "CVE-2024-49760"
+  ],
+  "summary": "OpenRefine has a path traversal in LoadLanguageCommand",
+  "details": "The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form `translations-$LANG.json`.\nWhen doing so, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to read other JSON files on the file system.\n\nThe command should be patched by checking that the normalized path is in the expected directory.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.openrefine:openrefine"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.8.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qfwq-6jh6-8xx4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenRefine/OpenRefine/commit/24d084052dc55426fe460f2a17524fd18d28b20c"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/OpenRefine/OpenRefine"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-24T18:32:40Z",
+    "nvd_published_at": null
+  }
+}