Log in Start free

Vulnerability · Published Jan 24, 2024 · Assigned by jpcert

CVE-2024-21796

Medium 5.5

In plain English

A medium-severity XML external entity in Electronic Deliverables Creation Support Tool (Construction Edition) from Ministry of Defense. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 90.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

Affected products (as reported)

VendorProductVersions
Ministry of Defense Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4
Ministry of Defense Electronic Deliverables Creation Support Tool (Design & Survey Edition) prior to Ver1.0.4

Weakness: CWE-611 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References