-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from insufficient protocol validation in the URL handling code. The function retrieveContentFromPostRequest accepted arbitrary protocols (like file://) when processing 'download' parameters. The patch added a protocol allowlist check (allowedProtocols) to block non-whitelisted protocols, and the test case added in ImportingUtilitiesTests.java demonstrates blocking 'file://' URLs. The absence of this protocol validation in vulnerable versions allowed access to internal resources via SSRF.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.openrefine:main | maven | < 3.6.0 | 3.6.0 |
Ongoing coverage of React2Shell