CVE-2024-21796

2024-01-2401:32:53

jpcert

www.cve.org

cve-2024-21796

xml external entity

electronic deliverables creation support tool

ver1.0.4 vulnerability

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

20.7%

JSON

Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

CNA Affected

[
  {
    "vendor": "Ministry of Defense",
    "product": "Electronic Deliverables Creation Support Tool (Construction Edition)",
    "versions": [
      {
        "version": "prior to Ver1.0.4",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Ministry of Defense",
    "product": "Electronic Deliverables Creation Support Tool (Design & Survey Edition)",
    "versions": [
      {
        "version": "prior to Ver1.0.4",
        "status": "affected"
      }
    ]
  }
]