Medium severity · published Jan 24, 2024
CVE-2024-21765
Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai)…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Electronic Delivery Check System (Dentsu) · Ministry of Land, Infrastructure, Transport and Tourism, Japan
Ver.12.1.0 and earlier · source: vendor
ED
Electronic Delivery Check System (Doboku) · Ministry of Land, Infrastructure, Transport and Tourism, Japan
Ver.18.1.0 and earlier · source: vendor
ED
Electronic Delivery Check System (Kikai) · Ministry of Land, Infrastructure, Transport and Tourism, Japan
Ver.10.1.0 and earlier · source: vendor
ED
Electronic delivery item Inspection Support System · Ministry of Land, Infrastructure, Transport and Tourism, Japan
Ver.4.0.31 and earlier · source: vendor, NVD
ED
Electronic Delivery Check System · Cals-ed
before 11.0.0; before 13.0.0; before 19.0.0 · source: NVD
Affected product
ED
Electronic Delivery Check System (Dentsu)
Ministry of Land, Infrastructure, Transport and Tourism, Japan