From 195ace1ad954bc37d409626703cc9f4b7d50f755 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 24 Oct 2024 18:33:47 +0000
Subject: [PATCH] Publish GHSA-qfwq-6jh6-8xx4

---
 .../GHSA-qfwq-6jh6-8xx4.json                  | 61 +++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/10/GHSA-qfwq-6jh6-8xx4/GHSA-qfwq-6jh6-8xx4.json

diff --git a/advisories/github-reviewed/2024/10/GHSA-qfwq-6jh6-8xx4/GHSA-qfwq-6jh6-8xx4.json b/advisories/github-reviewed/2024/10/GHSA-qfwq-6jh6-8xx4/GHSA-qfwq-6jh6-8xx4.json
new file mode 100644
index 00000000000..4220a79a92d
--- /dev/null
+++ b/advisories/github-reviewed/2024/10/GHSA-qfwq-6jh6-8xx4/GHSA-qfwq-6jh6-8xx4.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qfwq-6jh6-8xx4",
+  "modified": "2024-10-24T18:32:40Z",
+  "published": "2024-10-24T18:32:40Z",
+  "aliases": [
+    "CVE-2024-49760"
+  ],
+  "summary": "OpenRefine has a path traversal in LoadLanguageCommand",
+  "details": "The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form `translations-$LANG.json`.\nWhen doing so, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to read other JSON files on the file system.\n\nThe command should be patched by checking that the normalized path is in the expected directory.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.openrefine:openrefine"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.8.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qfwq-6jh6-8xx4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenRefine/OpenRefine/commit/24d084052dc55426fe460f2a17524fd18d28b20c"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/OpenRefine/OpenRefine"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-24T18:32:40Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file