Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
References
| Link | Resource |
|---|---|
| http://www.cals-ed.go.jp/checksys-release-20231130/ | Release Notes |
| https://jvn.jp/en/jp/JVN77736613/ | Third Party Advisory |
| https://www.ysk.nilim.go.jp/cals/ | Product |
Configurations
Configuration 1 (hide)
|
History
30 Jan 2024, 22:14
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () http://www.cals-ed.go.jp/checksys-release-20231130/ - Release Notes | |
| References | () https://www.ysk.nilim.go.jp/cals/ - Product | |
| References | () https://jvn.jp/en/jp/JVN77736613/ - Third Party Advisory | |
| First Time |
Cals-ed
Cals-ed electronic Delivery Item Inspection Support System Cals-ed electronic Delivery Check System |
|
| CWE | CWE-611 | |
| CPE | cpe:2.3:a:cals-ed:electronic_delivery_check_system:*:*:*:*:dentsu:*:*:* cpe:2.3:a:cals-ed:electronic_delivery_check_system:*:*:*:*:mechanical:*:*:* cpe:2.3:a:cals-ed:electronic_delivery_item_inspection_support_system:*:*:*:*:*:*:*:* cpe:2.3:a:cals-ed:electronic_delivery_check_system:*:*:*:*:doboku:*:*:* |
24 Jan 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-24 02:15
Updated : 2024-02-28 20:54
NVD link : CVE-2024-21765
Mitre link : CVE-2024-21765
CVE.ORG link : CVE-2024-21765
JSON object : View
Products Affected
cals-ed
- electronic_delivery_item_inspection_support_system
- electronic_delivery_check_system
CWE
CWE-611
Improper Restriction of XML External Entity Reference