XML External Entity Processing Vulnerability in National Land Numerical Information Tool by Japanese Ministry of Land, Infrastructure, Transport and Tourism
CVE-2023-25955

5.5MEDIUM

Key Information:

Vendor: Ministry Of Land, Infrastructure, Transport And Tourism, Japan
Status: National Land Numerical Information Data Conversion Tool
Vendor: CVE Published:; 11 April 2023

🔔 Create Ministry Of Land, Infrastructure, Transport And Tourism, Japan Vulnerability Alert

What is CVE-2023-25955?

The National Land Numerical Information data conversion tool is vulnerable to XML External Entity (XXE) attacks due to inadequate restrictions on XML entity processing. This vulnerability allows attackers to craft malicious XML files that can exploit the system, potentially granting access to arbitrary files on a user's machine. Organizations utilizing this tool should promptly evaluate their systems to mitigate related risks.

Affected Version(s)

National land numerical information data conversion tool all versions

References

https://nlftp.mlit.go.jp/i_news.html#news4

https://jvn.jp/en/jp/JVN75742861/

CVSS V3.1

Score:

5.5

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 11, 2023
Vulnerability Reserved
Mar 15, 2023

CVE-2023-25955 Data

JSON