CVE-2024-21796

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
Ministry of Defense	Electronic Deliverables Creation Support Tool (Construction Edition)	prior to Ver1.0.4
Ministry of Defense	Electronic Deliverables Creation Support Tool (Design & Survey Edition)	prior to Ver1.0.4

References

https://jvn.jp/en/jp/JVN40049211/Third Party Advisory
https://www.dfeg.mod.go.jp/hp/contents-dfis/tool.htmlProduct
https://jvn.jp/en/jp/JVN40049211/Third Party Advisory
https://www.dfeg.mod.go.jp/hp/contents-dfis/tool.htmlProduct

Timeline

Published: Jan 24, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-217977.2A command execution vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted CVE-2024-217984.8ELECOM wireless LAN routers contain a cross-site scripting vulnerability. Assume that a malicious administrative user configures the affecte CVE-2024-217997.1Path traversal for some Intel(R) Extension for Transformers software before version 1.5 may allow an authenticated user to potentially enabl CVE-2024-21805.5Zemana AntiLogger v2.74.204.664 is vulnerable to a Memory Information Leak vulnerability by triggering the 0x80002020 IOCTL code of the zam6 CVE-2024-218017.1Insufficient control flow management in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potent CVE-2024-218029.8A heap-based buffer overflow vulnerability exists in the GGUF library info->ne functionality of llama.cpp Commit 18c2e17. A specially cra CVE-2024-218037.8Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulner CVE-2024-218057.8Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prior to Ver.19.2. If thi CVE-2024-218065.5Improper conditions check in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version CVE-2024-218078.8Improper initialization in the Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may CVE-2024-218084.2Improper buffer restrictions in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escal CVE-2024-218097.3Improper conditions check for some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow an authenticated use