Lucene search

JpcertCVE-2023-46802

HistoryNov 06, 2023 - 2:15 a.m.

CVE-2023-46802

2023-11-0602:15:07

CWE-611

jpcert

web.nvd.nist.gov

e-tax software

version 3.0.10

xml

xxe

configuration

parser

arbitrary files

system

vulnerability

cve-2023-46802

nvd

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

20.7%

JSON

e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded XML parser. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

Affected configurations

Nvd

Vulners

Node

ntae-taxRange≤3.0.10

VendorProductVersionCPE
ntae-tax*cpe:2.3:a:nta:e-tax:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nta	e-tax	*	cpe:2.3:a:nta:e-tax::::::::

CNA Affected

[
  {
    "vendor": "National Tax Agency",
    "product": "e-Tax software",
    "versions": [
      {
        "version": "Version3.0.10 and earlier",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN14762986/

www.e-tax.nta.go.jp/topics/topics_20231102.htm

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

20.7%

JSON

Related for CVE-2023-46802