CVE-2024-21765

Опубликовано: 24 янв. 2024

Источник: nvd

CVSS3: 5.5

EPSS Низкий

Описание

Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

Ссылки

http://www.cals-ed.go.jp/checksys-release-20231130/
Release Notes
https://jvn.jp/en/jp/JVN77736613/
Third Party Advisory
https://www.ysk.nilim.go.jp/cals/
Product
http://www.cals-ed.go.jp/checksys-release-20231130/
Release Notes
https://jvn.jp/en/jp/JVN77736613/
Third Party Advisory
https://www.ysk.nilim.go.jp/cals/
Product

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cals-ed:electronic_delivery_check_system:*:*:*:*:mechanical:*:*:*

Версия до 11.0.0 (исключая)

cpe:2.3:a:cals-ed:electronic_delivery_check_system:*:*:*:*:dentsu:*:*:*

Версия до 13.0.0 (исключая)

cpe:2.3:a:cals-ed:electronic_delivery_check_system:*:*:*:*:doboku:*:*:*

Версия до 19.0.0 (исключая)

cpe:2.3:a:cals-ed:electronic_delivery_item_inspection_support_system:*:*:*:*:*:*:*:*

Версия до 4.0.31 (включая)

EPSS

Процентиль: 7%

0.00027

Низкий

5.5 Medium

CVSS3

Дефекты

CWE-611

Связанные уязвимости

GHSA-j48h-6x68-4fc5