Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for electronic_delivery_item_inspection_support_system by cals-ed

    CVE-2024-21765 (GCVE-0-2024-21765)

    Vulnerability from nvd – Published: 2024-01-24 01:32 – Updated: 2025-06-20 19:26
    VLAI
    Summary
    Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
    Severity
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • XML external entities (XXE)
    • CWE-611 - Improper Restriction of XML External Entity Reference
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:27:36.262Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.cals-ed.go.jp/checksys-release-20231130/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ysk.nilim.go.jp/cals/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN77736613/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-21765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-24T14:26:27.308398Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-611",
                "description": "CWE-611 Improper Restriction of XML External Entity Reference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-20T19:26:21.223Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Electronic Delivery Check System (Doboku)",
          "vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.18.1.0 and earlier"
            }
          ]
        },
        {
          "product": "Electronic Delivery Check System (Dentsu)",
          "vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.12.1.0 and earlier"
            }
          ]
        },
        {
          "product": "Electronic Delivery Check System (Kikai)",
          "vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.10.1.0 and earlier"
            }
          ]
        },
        {
          "product": "Electronic delivery item Inspection Support System",
          "vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.4.0.31 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XML external entities (XXE)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-24T01:32:42.611Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "http://www.cals-ed.go.jp/checksys-release-20231130/"
        },
        {
          "url": "https://www.ysk.nilim.go.jp/cals/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN77736613/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-21765",
    "datePublished": "2024-01-24T01:32:42.611Z",
    "dateReserved": "2024-01-12T07:58:24.236Z",
    "dateUpdated": "2025-06-20T19:26:21.223Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2024-21765 (GCVE-0-2024-21765)

    Vulnerability from cvelistv5 – Published: 2024-01-24 01:32 – Updated: 2025-06-20 19:26
    VLAI
    Summary
    Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
    Severity
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • XML external entities (XXE)
    • CWE-611 - Improper Restriction of XML External Entity Reference
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:27:36.262Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.cals-ed.go.jp/checksys-release-20231130/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ysk.nilim.go.jp/cals/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN77736613/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-21765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-24T14:26:27.308398Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-611",
                "description": "CWE-611 Improper Restriction of XML External Entity Reference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-20T19:26:21.223Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Electronic Delivery Check System (Doboku)",
          "vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.18.1.0 and earlier"
            }
          ]
        },
        {
          "product": "Electronic Delivery Check System (Dentsu)",
          "vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.12.1.0 and earlier"
            }
          ]
        },
        {
          "product": "Electronic Delivery Check System (Kikai)",
          "vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.10.1.0 and earlier"
            }
          ]
        },
        {
          "product": "Electronic delivery item Inspection Support System",
          "vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.4.0.31 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XML external entities (XXE)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-24T01:32:42.611Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "http://www.cals-ed.go.jp/checksys-release-20231130/"
        },
        {
          "url": "https://www.ysk.nilim.go.jp/cals/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN77736613/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-21765",
    "datePublished": "2024-01-24T01:32:42.611Z",
    "dateReserved": "2024-01-12T07:58:24.236Z",
    "dateUpdated": "2025-06-20T19:26:21.223Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}