CVE-2024-21796 — Ministry of Defense / Electronic Deliverables Creation Support Tool (Construction Edition)

Description (CNA)

Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

Affected (CNA)

Vendor / product	Versions
Ministry of Defense / Electronic Deliverables Creation Support Tool (Construction Edition)	affected prior to Ver1.0.4
Ministry of Defense / Electronic Deliverables Creation Support Tool (Design & Survey Edition)	affected prior to Ver1.0.4

CWE

No CWE identifiers supplied.

References

https://www.dfeg.mod.go.jp/hp/contents-dfis/tool.html
https://jvn.jp/en/jp/JVN40049211/

ADP enrichment

CVE

No English description supplied.

https://www.dfeg.mod.go.jp/hp/contents-dfis/tool.html
https://jvn.jp/en/jp/JVN40049211/

CISA-ADP

No English description supplied.

No references supplied.