CVE-2023-46802

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded XML parser. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
National Tax Agency	e-Tax software	Version3.0.10 and earlier

References

https://jvn.jp/en/jp/JVN14762986/Third Party Advisory
https://www.e-tax.nta.go.jp/topics/topics_20231102.htmProduct
https://jvn.jp/en/jp/JVN14762986/Third Party Advisory
https://www.e-tax.nta.go.jp/topics/topics_20231102.htmProduct

Timeline

Published: Nov 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-468037.5An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of CVE-2023-468047.5An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of CVE-2023-468058.2An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to acc CVE-2023-468066.7An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege t CVE-2023-468076.7An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or CVE-2023-468089.9An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Success CVE-2023-468097.4Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are CVE-2023-46815.5NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-468107.3A local privilege escalation vulnerability in Ivanti Secure Access Client for Linux before 22.7R1, allows a low privileged user to execute c CVE-2023-468137.0An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect acce CVE-2023-468147.8A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. The uninstaller attempts to execute c CVE-2023-468158.8An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in