CVE-2024-21765

MEDIUM

Cals-ed Electronic Delivery Check System < 11.0.0 - XXE

Title source: rule

Description

Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

References (3)

[Release Notes] http://www.cals-ed.go.jp/checksys-release-20231130/

[Third Party Advisory] https://jvn.jp/en/jp/JVN77736613/

[Product] https://www.ysk.nilim.go.jp/cals/

Scores

CVSS v3 5.5

EPSS 0.0003

EPSS Percentile 7.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-611

Status published

Products (4)

cals-ed/electronic_delivery_check_system < 11.0.0

cals-ed/electronic_delivery_check_system < 13.0.0

cals-ed/electronic_delivery_check_system < 19.0.0

cals-ed/electronic_delivery_item_inspection_support_system < 4.0.31

Published Jan 24, 2024

Tracked Since Feb 18, 2026