Improper XML External Entity Handling in Electronic Delivery Check System Products
CVE-2024-21765

5.5MEDIUM

Key Information:

Vendor: Ministry Of Land, Infrastructure, Transport And Tourism, Japan
Status: Electronic Delivery Check System (doboku); Electronic Delivery Check System (dentsu); Electronic Delivery Check System (kikai); Electronic Delivery Item Inspection Support System
Vendor: CVE Published:; 24 January 2024

🔔 Create Ministry Of Land, Infrastructure, Transport And Tourism, Japan Vulnerability Alert

What is CVE-2024-21765?

The Electronic Delivery Check System products, specifically versions of Doboku, Dentsu, Kikai, and the Item Inspection Support System, are vulnerable to improper handling of XML external entity references. This allows attackers to craft malicious XML files that can exploit this vulnerability, potentially granting them access to arbitrary files on the host system. This poses significant risks to data integrity and confidentiality, warranting immediate attention from users to ensure that their systems are not compromised.

Affected Version(s)

Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier

Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier

Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier

References

http://www.cals-ed.go.jp/checksys-release-20231130/

https://www.ysk.nilim.go.jp/cals/

https://jvn.jp/en/jp/JVN77736613/

CVSS V3.1

Score:

5.5

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 24, 2024
Vulnerability Reserved
Jan 12, 2024

CVE-2024-21765 Data

JSON