Lucene search

Japan Vulnerability NotesJVN:14762986

HistoryNov 02, 2023 - 12:00 a.m.

JVN#14762986: Improper restriction of XML external entity references (XXE) in e-Tax software

2023-11-0200:00:00

Japan Vulnerability Notes

jvn.jp

xxe

e-tax software

cwe-611

update software

national tax agency

internal files exposure.

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

20.7%

JSON

e-Tax software provided by National Tax Agency improperly restricts XML external entity references (XXE) (CWE-611) due to the configuration of the embedded XML parser.

Impact

Processing a specially crafted XML file may lead to exposure of internal files on the system.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.

Products Affected

e-Tax software Version3.0.10 and earlier

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

20.7%

JSON

Related for JVN:14762986