Lucene search

JpcertCVE-2023-42132

HistoryOct 02, 2023 - 5:15 a.m.

CVE-2023-42132

2023-10-0205:15:26

CWE-611

jpcert

web.nvd.nist.gov

cve-2023-42132

fd application

xml

xxe

vulnerability

security

nvd

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

20.7%

JSON

FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

Affected configurations

Nvd

Node

mhlwfd_applicationRange≤9.01

VendorProductVersionCPE
mhlwfd_application*cpe:2.3:a:mhlw:fd_application:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mhlw	fd_application	*	cpe:2.3:a:mhlw:fd_application::::::::

CNA Affected

[
  {
    "vendor": "Ministry of Health, Labour and Welfare",
    "product": "FD Application",
    "versions": [
      {
        "version": "Apr. 2022 Edition (Version 9.01) and earlier",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN39596244/

web.fd-shinsei.mhlw.go.jp/download/software/index.html

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

20.7%

JSON

Related for CVE-2023-42132