Search

Find a vulnerability

Search criteria

    3 vulnerabilities by Ministry of Health, Labour and Welfare

    CVE-2023-42132 (GCVE-0-2023-42132)

    Vulnerability from nvd – Published: 2023-10-02 04:12 – Updated: 2024-09-20 16:49
    VLAI
    Summary
    FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
    Severity
    No CVSS data available.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • XML external entities (XXE)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Ministry of Health, Labour and Welfare FD Application Affected: Apr. 2022 Edition (Version 9.01) and earlier
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:16:50.612Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://web.fd-shinsei.mhlw.go.jp/download/software/index.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN39596244/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-42132",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T16:49:41.095907Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T16:49:53.053Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FD Application",
          "vendor": "Ministry of Health, Labour and Welfare",
          "versions": [
            {
              "status": "affected",
              "version": "Apr. 2022 Edition (Version 9.01) and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XML external entities (XXE)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-02T04:12:32.133Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://web.fd-shinsei.mhlw.go.jp/download/software/index.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN39596244/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-42132",
    "datePublished": "2023-10-02T04:12:32.133Z",
    "dateReserved": "2023-09-07T05:21:30.785Z",
    "dateUpdated": "2024-09-20T16:49:53.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2023-42132 (GCVE-0-2023-42132)

    Vulnerability from cvelistv5 – Published: 2023-10-02 04:12 – Updated: 2024-09-20 16:49
    VLAI
    Summary
    FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
    Severity
    No CVSS data available.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • XML external entities (XXE)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Ministry of Health, Labour and Welfare FD Application Affected: Apr. 2022 Edition (Version 9.01) and earlier
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:16:50.612Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://web.fd-shinsei.mhlw.go.jp/download/software/index.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN39596244/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-42132",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T16:49:41.095907Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T16:49:53.053Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FD Application",
          "vendor": "Ministry of Health, Labour and Welfare",
          "versions": [
            {
              "status": "affected",
              "version": "Apr. 2022 Edition (Version 9.01) and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XML external entities (XXE)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-02T04:12:32.133Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://web.fd-shinsei.mhlw.go.jp/download/software/index.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN39596244/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-42132",
    "datePublished": "2023-10-02T04:12:32.133Z",
    "dateReserved": "2023-09-07T05:21:30.785Z",
    "dateUpdated": "2024-09-20T16:49:53.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    JVNDB-2023-000096

    Vulnerability from jvndb - Published: 2023-10-02 12:36 - Updated:2024-05-22 15:37
    Severity
    2.5 (Low) - cvssV3_0 - CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
    Summary
    Improper restriction of XML external entity references (XXE) in FD Application
    Details
    FD Application provided by Ministry of Health, Labour and Welfare improperly restricts XML external entity references (XXE) (CWE-611). Toyama Taku and Sakaki Ryutaro of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
    References
    Impacted products
    Show details on JVN DB website
    To clipboard 

    {
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000096.html",
  "dc:date": "2024-05-22T15:37+09:00",
  "dcterms:issued": "2023-10-02T12:36+09:00",
  "dcterms:modified": "2024-05-22T15:37+09:00",
  "description": "FD Application provided by Ministry of Health, Labour and Welfare improperly restricts XML external entity references (XXE) (CWE-611).\r\n\r\nToyama Taku and Sakaki Ryutaro of NEC Corporation reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000096.html",
  "sec:cpe": {
    "#text": "cpe:/a:mhlw:fd_application",
    "@product": "FD Application",
    "@vendor": "Ministry of Health, Labour and Welfare",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "1.2",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "2.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000096",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN39596244/index.html",
      "@id": "JVN#39596244",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-42132",
      "@id": "CVE-2023-42132",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-42132",
      "@id": "CVE-2023-42132",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Improper restriction of XML external entity references (XXE) in FD Application"
}