« Volver al listado

CVE-2024-21765

Estado: ModificadaMedia (5.5)—

Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Cals-ed — Electronic Delivery Check SystemCals-ed — Electronic Delivery Item Inspection Support System

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-21765",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-21765",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-01-24T14:26:27.308398Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
          "product": "Electronic Delivery Check System (Doboku)",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.18.1.0 and earlier"
            }
          ]
        },
        {
          "vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
          "product": "Electronic Delivery Check System (Dentsu)",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.12.1.0 and earlier"
            }
          ]
        },
        {
          "vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
          "product": "Electronic Delivery Check System (Kikai)",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.10.1.0 and earlier"
            }
          ]
        },
        {
          "vendor": "Ministry of Land, Infrastructure, Transport and Tourism, Japan",
          "product": "Electronic delivery item Inspection Support System",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.4.0.31 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-01-24T02:15:07.110",
  "references": [
    {
      "url": "http://www.cals-ed.go.jp/checksys-release-20231130/",
      "tags": [
        "Release Notes"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN77736613/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.ysk.nilim.go.jp/cals/",
      "tags": [
        "Product"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://www.cals-ed.go.jp/checksys-release-20231130/",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN77736613/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.ysk.nilim.go.jp/cals/",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker."
    },
    {
      "lang": "es",
      "value": "Electronic Delivery Check System (Doboku) versión 18.1.0 y anterior,\nElectronic Delivery Check System (Dentsu) versión 12.1.0 y anterior,\nElectronic Delivery Check System (Kikai) versión 10.1.0 y anterior, y\nElectronic delivery item Inspection Support SystemVer.4.0.31 y anteriores,\nrestringen incorrectamente las referencias de entidades externas XML (XXE). Al procesar un archivo XML especialmente manipulado, un atacante puede leer archivos arbitrarios del sistema."
    }
  ],
  "lastModified": "2026-06-17T07:10:07.363",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cals-ed:electronic_delivery_check_system:*:*:*:*:mechanical:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C64D3573-59E1-4CCD-A761-83D23FD4C2E2",
              "versionEndExcluding": "11.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cals-ed:electronic_delivery_check_system:*:*:*:*:dentsu:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC3FCDF8-7C2E-4302-971B-4717C6026215",
              "versionEndExcluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cals-ed:electronic_delivery_check_system:*:*:*:*:doboku:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E40D18DA-A075-4C2B-8EDA-C2E070F1A46C",
              "versionEndExcluding": "19.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cals-ed:electronic_delivery_item_inspection_support_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D31CF60-2F4A-4AEA-AA46-F5E54CFF5A50",
              "versionEndIncluding": "4.0.31"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}