« Volver al listado

CVE-2019-5918

Estado: ModificadaCrítica (9.1)—

Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Nablarch Project — Nablarch

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-5918",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 7.8,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "TIS Inc.",
          "product": "Nablarch 5",
          "versions": [
            {
              "status": "affected",
              "version": "Nablarch 5, and 5u1 to 5u13"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-03-12T22:29:00.863",
  "references": [
    {
      "url": "http://jvn.jp/en/jp/JVN56542712/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://nablarch.atlassian.net/projects/NAB/issues/NAB-295",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://jvn.jp/en/jp/JVN56542712/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://nablarch.atlassian.net/projects/NAB/issues/NAB-295",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Nablarch 5 (5 y desde la versión 5u1 hasta la 5u13) permite a los atacantes remotos realizar ataques de XEE (XML External Entity) mediante vectores sin especificar."
    }
  ],
  "lastModified": "2026-06-17T02:38:24.947",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nablarch_project:nablarch:5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B05E580A-3F3C-45BC-B8D0-AB89E8B7DDA8"
            },
            {
              "criteria": "cpe:2.3:a:nablarch_project:nablarch:5u1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC8E2C1D-6523-4B2F-B936-E3E97A7C24FC"
            },
            {
              "criteria": "cpe:2.3:a:nablarch_project:nablarch:5u13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4569B57-F7DD-40FC-AB44-0810895E921E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}