JVN#56542712: Multiple vulnerabilities in Nablarch

Nablarch provided by TIS Inc. contains multiple vulnerabilities listed below.

The vulnerability in the function of generic formatter by XXE attacks (CWE-611) - CVE-2019-5918

An incomplete cryptography of the data store function by using hidden tag (CWE-310) - CVE-2019-5919

Impact

• An XXE attack may be conducted by a remote attacker. As a resut, information leakage may occur or the system may stop - CVE-2019-5918
• Information of the stored data may be obtained and invalid value may be registered or the value may be altered - CVE-2019-5919

Solution

Apply an Update
Update to the latest version according to the information provided by the developer.

Apply a Workaround
Please refer to the developer’s information for the details.

Products Affected

• Nablarch 5 (5, and 5u1 to 5u13)