CVE-2024-22380

MEDIUM Year: 2024
CVSS v3 Score
5.5
Medium
Weakness Type
CWE-611
View all →

Vulnerability Description

Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

Related Vulnerabilities

CVE-2012-5656

MEDIUM
CVSS:5.5(Medium)

The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.

CWE-6112012

CVE-2016-5000

MEDIUM
CVSS:5.5(Medium)

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity re...

CWE-6112016

CVE-2016-5748

MEDIUM
CVSS:5.5(Medium)

External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to disclose the content of local fi...

CWE-6112016

CVE-2016-5749

MEDIUM
CVSS:5.5(Medium)

NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML Externa...

CWE-6112016

CVE-2016-9318

MEDIUM
CVSS:5.5(Medium)

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, w...

CWE-6112016

CVE-2017-15280

MEDIUM
CVSS:5.5(Medium)

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF)...

CWE-6112017