{"action":"Upgrade org.openrefine:openrefine to 3.8.3 or later.","affected":[{"fixed":"3.8.3","introduced":"0"}],"component":"org.openrefine:openrefine","cve_ids":["CVE-2024-47882"],"ecosystem":"Maven","epss":0.0051,"exploited":false,"fixed_versions":["3.8.3"],"ghsa_id":"GHSA-j8hp-f2mj-586g","id":"tcs_01M5N92DZ6NBSK5W4WPQQX3KDS","modified_at":"2024-10-24T22:39:42.380349Z","published_at":"2024-10-24T18:13:04Z","references":["https://osv.dev/vulnerability/GHSA-j8hp-f2mj-586g","https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-j8hp-f2mj-586g","https://nvd.nist.gov/vuln/detail/CVE-2024-47882","https://github.com/OpenRefine/OpenRefine/commit/85594e75e7b36025f7b6a67dcd3ec253c5dff8c2","https://github.com/OpenRefine/OpenRefine","https://github.com/OpenRefine/OpenRefine/blob/master/main/webapp/modules/core/error.vt#L52-L53"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-j8hp-f2mj-586g","url":"https://osv.dev/vulnerability/GHSA-j8hp-f2mj-586g"}],"summary":"OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project"}