Search criteria

3 vulnerabilities found for FD Application by Ministry of Health, Labour and Welfare

CVE-2023-42132 (GCVE-0-2023-42132)

Vulnerability from cvelistv5 – Published: 2023-10-02 04:12 – Updated: 2024-09-20 16:49
VLAI?
Summary
FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
Severity ?
No CVSS data available.
CWE
  • XML external entities (XXE)
Assigner
References
Impacted products
Vendor Product Version
Ministry of Health, Labour and Welfare FD Application Affected: Apr. 2022 Edition (Version 9.01) and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:16:50.612Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://web.fd-shinsei.mhlw.go.jp/download/software/index.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN39596244/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-42132",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T16:49:41.095907Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T16:49:53.053Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FD Application",
          "vendor": "Ministry of Health, Labour and Welfare",
          "versions": [
            {
              "status": "affected",
              "version": "Apr. 2022 Edition (Version 9.01) and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XML external entities (XXE)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-02T04:12:32.133Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://web.fd-shinsei.mhlw.go.jp/download/software/index.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN39596244/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-42132",
    "datePublished": "2023-10-02T04:12:32.133Z",
    "dateReserved": "2023-09-07T05:21:30.785Z",
    "dateUpdated": "2024-09-20T16:49:53.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-42132 (GCVE-0-2023-42132)

Vulnerability from nvd – Published: 2023-10-02 04:12 – Updated: 2024-09-20 16:49
VLAI?
Summary
FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
Severity ?
No CVSS data available.
CWE
  • XML external entities (XXE)
Assigner
References
Impacted products
Vendor Product Version
Ministry of Health, Labour and Welfare FD Application Affected: Apr. 2022 Edition (Version 9.01) and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:16:50.612Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://web.fd-shinsei.mhlw.go.jp/download/software/index.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN39596244/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-42132",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T16:49:41.095907Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T16:49:53.053Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FD Application",
          "vendor": "Ministry of Health, Labour and Welfare",
          "versions": [
            {
              "status": "affected",
              "version": "Apr. 2022 Edition (Version 9.01) and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XML external entities (XXE)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-02T04:12:32.133Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://web.fd-shinsei.mhlw.go.jp/download/software/index.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN39596244/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-42132",
    "datePublished": "2023-10-02T04:12:32.133Z",
    "dateReserved": "2023-09-07T05:21:30.785Z",
    "dateUpdated": "2024-09-20T16:49:53.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

JVNDB-2023-000096

Vulnerability from jvndb - Published: 2023-10-02 12:36 - Updated:2024-05-22 15:37
Severity ?
2.5 (Low) - cvssV3_0 - CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
Improper restriction of XML external entity references (XXE) in FD Application
Details
FD Application provided by Ministry of Health, Labour and Welfare improperly restricts XML external entity references (XXE) (CWE-611). Toyama Taku and Sakaki Ryutaro of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000096.html",
  "dc:date": "2024-05-22T15:37+09:00",
  "dcterms:issued": "2023-10-02T12:36+09:00",
  "dcterms:modified": "2024-05-22T15:37+09:00",
  "description": "FD Application provided by Ministry of Health, Labour and Welfare improperly restricts XML external entity references (XXE) (CWE-611).\r\n\r\nToyama Taku and Sakaki Ryutaro of NEC Corporation reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000096.html",
  "sec:cpe": {
    "#text": "cpe:/a:mhlw:fd_application",
    "@product": "FD Application",
    "@vendor": "Ministry of Health, Labour and Welfare",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "1.2",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "2.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000096",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN39596244/index.html",
      "@id": "JVN#39596244",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-42132",
      "@id": "CVE-2023-42132",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-42132",
      "@id": "CVE-2023-42132",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Improper restriction of XML external entity references (XXE) in FD Application"
}