What is CVE-2024-22380?

CVE-2024-22380 is a medium-severity vulnerability in Maff Electronic Delivery Check System, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.5/10. Published 2024-01-24.

How severe is CVE-2024-22380?

Medium severity. CVSS v3 base score is 5.5 out of 10.

XXE in Maff Electronic Delivery Check System

CVE-2024-22380

Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.002 (12.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

Affected products

Maff Electronic_delivery_check_system
Ministry Of Agriculture, Forestry And Fisheries Electronic Delivery Check System (Ministry The Agriculture Rural Development Project Version) March, Heisei 31 Era Edition — versions Ver.14.0.001.002 and earlier

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

vultures@jpcert.or.jp (Release Notes)
vultures@jpcert.or.jp (Third Party Advisory)

Frequently asked questions

What is CVE-2024-22380?: CVE-2024-22380 is a medium-severity vulnerability in Maff Electronic Delivery Check System, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.5/10. Published 2024-01-24.
How severe is CVE-2024-22380?: Medium severity. CVSS v3 base score is 5.5 out of 10.