Lucene search

JpcertCVE-2023-27527

HistoryMay 10, 2023 - 6:15 a.m.

CVE-2023-27527

2023-05-1006:15:13

CWE-611

jpcert

web.nvd.nist.gov

cve-2023-27527

shinseiyo sogo soft

xml

xxe

vulnerability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

60.8%

JSON

Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.

Affected configurations

Nvd

Node

touki-kyoutaku-onlineshinseiyo_sogo_softRange≤7.9a

VendorProductVersionCPE
touki-kyoutaku-onlineshinseiyo_sogo_soft*cpe:2.3:a:touki-kyoutaku-online:shinseiyo_sogo_soft:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
touki-kyoutaku-online	shinseiyo_sogo_soft	*	cpe:2.3:a:touki-kyoutaku-online:shinseiyo_sogo_soft::::::::

CNA Affected

[
  {
    "vendor": "The Ministry of Justice",
    "product": "Shinseiyo Sogo Soft",
    "versions": [
      {
        "version": "(7.9A) and earlier",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN73178249/

www.touki-kyoutaku-online.moj.go.jp/

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

60.8%

JSON

Related for CVE-2023-27527