Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for UYAP Document Editor by Ministry of Justice

    CVE-2026-16999 (GCVE-0-2026-16999)

    Vulnerability from nvd – Published: 2026-08-12 13:53 – Updated: 2026-08-12 18:47
    VLAI
    Title
    XXE in Ministry of Justice's UYAP Document Editor
    Summary
    Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
    Severity
    6.3 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-12 18:47 UTC
    CWE
    • CWE-611 - Improper restriction of XML external entity reference
    Assigner
    References
    Impacted products
    Vendor Product Version
    Ministry of Justice UYAP Document Editor Affected: 4.5.17 , < 5.4.17 (custom)
    		Create a notification for this product.
    Date Public
    2026-08-12 13:45
    Credits
    Mustafa Anıl YILDIRIM Begüm ERDAL
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16999",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T18:47:07.671400Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T18:47:18.379Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "UYAP Document Editor",
          "vendor": "Ministry of Justice",
          "versions": [
            {
              "lessThan": "5.4.17",
              "status": "affected",
              "version": "4.5.17",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mustafa An\u0131l YILDIRIM"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Beg\u00fcm ERDAL"
        }
      ],
      "datePublic": "2026-08-12T13:45:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.\u003cp\u003eThis issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.\u003c/p\u003e"
            }
          ],
          "value": "Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.\n\nThis issue affects UYAP Document Editor: from 4.5.17 before 5.4.17."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-201",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-201 Serialized Data External Linking"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611 Improper restriction of XML external entity reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T13:53:18.644Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0818"
        }
      ],
      "source": {
        "advisory": "TR-26-0818",
        "defect": [
          "TR-26-0818"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "XXE in Ministry of Justice\u0027s UYAP Document Editor",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-16999",
    "datePublished": "2026-08-12T13:53:18.644Z",
    "dateReserved": "2026-07-24T09:22:51.337Z",
    "dateUpdated": "2026-08-12T18:47:18.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-16999 (GCVE-0-2026-16999)

    Vulnerability from cvelistv5 – Published: 2026-08-12 13:53 – Updated: 2026-08-12 18:47
    VLAI
    Title
    XXE in Ministry of Justice's UYAP Document Editor
    Summary
    Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
    Severity
    6.3 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-12 18:47 UTC
    CWE
    • CWE-611 - Improper restriction of XML external entity reference
    Assigner
    References
    Impacted products
    Vendor Product Version
    Ministry of Justice UYAP Document Editor Affected: 4.5.17 , < 5.4.17 (custom)
    		Create a notification for this product.
    Date Public
    2026-08-12 13:45
    Credits
    Mustafa Anıl YILDIRIM Begüm ERDAL
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16999",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T18:47:07.671400Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T18:47:18.379Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "UYAP Document Editor",
          "vendor": "Ministry of Justice",
          "versions": [
            {
              "lessThan": "5.4.17",
              "status": "affected",
              "version": "4.5.17",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mustafa An\u0131l YILDIRIM"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Beg\u00fcm ERDAL"
        }
      ],
      "datePublic": "2026-08-12T13:45:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.\u003cp\u003eThis issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.\u003c/p\u003e"
            }
          ],
          "value": "Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.\n\nThis issue affects UYAP Document Editor: from 4.5.17 before 5.4.17."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-201",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-201 Serialized Data External Linking"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611 Improper restriction of XML external entity reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T13:53:18.644Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0818"
        }
      ],
      "source": {
        "advisory": "TR-26-0818",
        "defect": [
          "TR-26-0818"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "XXE in Ministry of Justice\u0027s UYAP Document Editor",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-16999",
    "datePublished": "2026-08-12T13:53:18.644Z",
    "dateReserved": "2026-07-24T09:22:51.337Z",
    "dateUpdated": "2026-08-12T18:47:18.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}