Search
Find a vulnerability
Search criteria
6 vulnerabilities by Ministry of Land, Infrastructure, Transport and Tourism, Japan
CVE-2024-21765 (GCVE-0-2024-21765)
Vulnerability from nvd – Published: 2024-01-24 01:32 – Updated: 2025-06-20 19:26
VLAI
Summary
Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- XML external entities (XXE)
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | Electronic Delivery Check System (Doboku) |
Affected:
Ver.18.1.0 and earlier
|
|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | Electronic Delivery Check System (Dentsu) |
Affected:
Ver.12.1.0 and earlier
|
|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | Electronic Delivery Check System (Kikai) |
Affected:
Ver.10.1.0 and earlier
|
|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | Electronic delivery item Inspection Support System |
Affected:
Ver.4.0.31 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:27:36.262Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://www.cals-ed.go.jp/checksys-release-20231130/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.ysk.nilim.go.jp/cals/"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN77736613/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-21765",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-24T14:26:27.308398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-20T19:26:21.223Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Electronic Delivery Check System (Doboku)",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "Ver.18.1.0 and earlier"
}
]
},
{
"product": "Electronic Delivery Check System (Dentsu)",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "Ver.12.1.0 and earlier"
}
]
},
{
"product": "Electronic Delivery Check System (Kikai)",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "Ver.10.1.0 and earlier"
}
]
},
{
"product": "Electronic delivery item Inspection Support System",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "Ver.4.0.31 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XML external entities (XXE)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-24T01:32:42.611Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "http://www.cals-ed.go.jp/checksys-release-20231130/"
},
{
"url": "https://www.ysk.nilim.go.jp/cals/"
},
{
"url": "https://jvn.jp/en/jp/JVN77736613/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-21765",
"datePublished": "2024-01-24T01:32:42.611Z",
"dateReserved": "2024-01-12T07:58:24.236Z",
"dateUpdated": "2025-06-20T19:26:21.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-25955 (GCVE-0-2023-25955)
Vulnerability from nvd – Published: 2023-04-11 00:00 – Updated: 2025-02-10 15:58
VLAI
Summary
National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper restriction of XML external entity reference (XXE)
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | National land numerical information data conversion tool |
Affected:
all versions
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:39:06.137Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://nlftp.mlit.go.jp/i_news.html#news4"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN75742861/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-25955",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-10T15:57:12.687117Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-10T15:58:18.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "National land numerical information data conversion tool",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "all versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper restriction of XML external entity reference (XXE)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-11T00:00:00.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://nlftp.mlit.go.jp/i_news.html#news4"
},
{
"url": "https://jvn.jp/en/jp/JVN75742861/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-25955",
"datePublished": "2023-04-11T00:00:00.000Z",
"dateReserved": "2023-03-15T00:00:00.000Z",
"dateUpdated": "2025-02-10T15:58:18.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-2231 (GCVE-0-2017-2231)
Vulnerability from nvd – Published: 2017-07-07 13:00 – Updated: 2024-08-05 13:48
VLAI
Summary
Untrusted search path vulnerability in The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till June 20, 2017, The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till June 20, 2017 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Severity
No CVSS data available.
CWE
- Untrusted search path vulnerability
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.mlit.go.jp/gobuild/gobuild_cals_sysv3.html | x_refsource_MISC |
| http://jvn.jp/en/jp/JVN06337557/index.html | third-party-advisoryx_refsource_JVN |
| http://www.mlit.go.jp/common/001189444.pdf | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system |
Affected:
Ver3.02 and earlier, distributed till June 20, 2017
|
|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system |
Affected:
Ver3.02 and earlier, distributed till June 20, 2017
|
Date Public
2017-07-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T13:48:05.218Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.mlit.go.jp/gobuild/gobuild_cals_sysv3.html"
},
{
"name": "JVN#06337557",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN06337557/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.mlit.go.jp/common/001189444.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "Ver3.02 and earlier, distributed till June 20, 2017"
}
]
},
{
"product": "The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "Ver3.02 and earlier, distributed till June 20, 2017"
}
]
}
],
"datePublic": "2017-07-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till June 20, 2017, The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till June 20, 2017 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Untrusted search path vulnerability",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-07T12:57:01.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.mlit.go.jp/gobuild/gobuild_cals_sysv3.html"
},
{
"name": "JVN#06337557",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN06337557/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.mlit.go.jp/common/001189444.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2017-2231",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system",
"version": {
"version_data": [
{
"version_value": "Ver3.02 and earlier, distributed till June 20, 2017"
}
]
}
},
{
"product_name": "The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system",
"version": {
"version_data": [
{
"version_value": "Ver3.02 and earlier, distributed till June 20, 2017"
}
]
}
}
]
},
"vendor_name": "Ministry of Land, Infrastructure, Transport and Tourism, Japan"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability in The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till June 20, 2017, The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till June 20, 2017 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.mlit.go.jp/gobuild/gobuild_cals_sysv3.html",
"refsource": "MISC",
"url": "http://www.mlit.go.jp/gobuild/gobuild_cals_sysv3.html"
},
{
"name": "JVN#06337557",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN06337557/index.html"
},
{
"name": "http://www.mlit.go.jp/common/001189444.pdf",
"refsource": "MISC",
"url": "http://www.mlit.go.jp/common/001189444.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2017-2231",
"datePublished": "2017-07-07T13:00:00.000Z",
"dateReserved": "2016-12-01T00:00:00.000Z",
"dateUpdated": "2024-08-05T13:48:05.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-21765 (GCVE-0-2024-21765)
Vulnerability from cvelistv5 – Published: 2024-01-24 01:32 – Updated: 2025-06-20 19:26
VLAI
Summary
Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- XML external entities (XXE)
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | Electronic Delivery Check System (Doboku) |
Affected:
Ver.18.1.0 and earlier
|
|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | Electronic Delivery Check System (Dentsu) |
Affected:
Ver.12.1.0 and earlier
|
|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | Electronic Delivery Check System (Kikai) |
Affected:
Ver.10.1.0 and earlier
|
|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | Electronic delivery item Inspection Support System |
Affected:
Ver.4.0.31 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:27:36.262Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://www.cals-ed.go.jp/checksys-release-20231130/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.ysk.nilim.go.jp/cals/"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN77736613/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-21765",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-24T14:26:27.308398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-20T19:26:21.223Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Electronic Delivery Check System (Doboku)",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "Ver.18.1.0 and earlier"
}
]
},
{
"product": "Electronic Delivery Check System (Dentsu)",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "Ver.12.1.0 and earlier"
}
]
},
{
"product": "Electronic Delivery Check System (Kikai)",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "Ver.10.1.0 and earlier"
}
]
},
{
"product": "Electronic delivery item Inspection Support System",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "Ver.4.0.31 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XML external entities (XXE)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-24T01:32:42.611Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "http://www.cals-ed.go.jp/checksys-release-20231130/"
},
{
"url": "https://www.ysk.nilim.go.jp/cals/"
},
{
"url": "https://jvn.jp/en/jp/JVN77736613/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-21765",
"datePublished": "2024-01-24T01:32:42.611Z",
"dateReserved": "2024-01-12T07:58:24.236Z",
"dateUpdated": "2025-06-20T19:26:21.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-25955 (GCVE-0-2023-25955)
Vulnerability from cvelistv5 – Published: 2023-04-11 00:00 – Updated: 2025-02-10 15:58
VLAI
Summary
National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper restriction of XML external entity reference (XXE)
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | National land numerical information data conversion tool |
Affected:
all versions
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:39:06.137Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://nlftp.mlit.go.jp/i_news.html#news4"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN75742861/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-25955",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-10T15:57:12.687117Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-10T15:58:18.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "National land numerical information data conversion tool",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "all versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper restriction of XML external entity reference (XXE)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-11T00:00:00.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://nlftp.mlit.go.jp/i_news.html#news4"
},
{
"url": "https://jvn.jp/en/jp/JVN75742861/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-25955",
"datePublished": "2023-04-11T00:00:00.000Z",
"dateReserved": "2023-03-15T00:00:00.000Z",
"dateUpdated": "2025-02-10T15:58:18.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-2231 (GCVE-0-2017-2231)
Vulnerability from cvelistv5 – Published: 2017-07-07 13:00 – Updated: 2024-08-05 13:48
VLAI
Summary
Untrusted search path vulnerability in The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till June 20, 2017, The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till June 20, 2017 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Severity
No CVSS data available.
CWE
- Untrusted search path vulnerability
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.mlit.go.jp/gobuild/gobuild_cals_sysv3.html | x_refsource_MISC |
| http://jvn.jp/en/jp/JVN06337557/index.html | third-party-advisoryx_refsource_JVN |
| http://www.mlit.go.jp/common/001189444.pdf | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system |
Affected:
Ver3.02 and earlier, distributed till June 20, 2017
|
|
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system |
Affected:
Ver3.02 and earlier, distributed till June 20, 2017
|
Date Public
2017-07-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T13:48:05.218Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.mlit.go.jp/gobuild/gobuild_cals_sysv3.html"
},
{
"name": "JVN#06337557",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN06337557/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.mlit.go.jp/common/001189444.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "Ver3.02 and earlier, distributed till June 20, 2017"
}
]
},
{
"product": "The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system",
"vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
"versions": [
{
"status": "affected",
"version": "Ver3.02 and earlier, distributed till June 20, 2017"
}
]
}
],
"datePublic": "2017-07-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till June 20, 2017, The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till June 20, 2017 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Untrusted search path vulnerability",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-07T12:57:01.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.mlit.go.jp/gobuild/gobuild_cals_sysv3.html"
},
{
"name": "JVN#06337557",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN06337557/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.mlit.go.jp/common/001189444.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2017-2231",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system",
"version": {
"version_data": [
{
"version_value": "Ver3.02 and earlier, distributed till June 20, 2017"
}
]
}
},
{
"product_name": "The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system",
"version": {
"version_data": [
{
"version_value": "Ver3.02 and earlier, distributed till June 20, 2017"
}
]
}
}
]
},
"vendor_name": "Ministry of Land, Infrastructure, Transport and Tourism, Japan"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability in The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till June 20, 2017, The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.02 and earlier, distributed till June 20, 2017 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.mlit.go.jp/gobuild/gobuild_cals_sysv3.html",
"refsource": "MISC",
"url": "http://www.mlit.go.jp/gobuild/gobuild_cals_sysv3.html"
},
{
"name": "JVN#06337557",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN06337557/index.html"
},
{
"name": "http://www.mlit.go.jp/common/001189444.pdf",
"refsource": "MISC",
"url": "http://www.mlit.go.jp/common/001189444.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2017-2231",
"datePublished": "2017-07-07T13:00:00.000Z",
"dateReserved": "2016-12-01T00:00:00.000Z",
"dateUpdated": "2024-08-05T13:48:05.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}