CVE-2024-22380

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
Ministry of Agriculture, Forestry and Fisheries	Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition	Ver.14.0.001.002 and earlier

References

https://jvn.jp/en/jp/JVN01434915/Third Party Advisory
https://www.maff.go.jp/j/nousin/seko/nouhin_youryou/densi.htmlRelease Notes
https://jvn.jp/en/jp/JVN01434915/Third Party Advisory
https://www.maff.go.jp/j/nousin/seko/nouhin_youryou/densi.htmlRelease Notes

Timeline

Published: Jan 24, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-223827.5Improper input validation in PprRequestLog module in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged us CVE-2024-223836.2Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not aut CVE-2024-223842.8Out-of-bounds read for some Intel(R) Trace Analyzer and Collector software before version 2022.0.0 published Nov 2023 may allow an authentic CVE-2024-223854.4Incorrect Default Permissions vulnerability in Hitachi Storage Provider for VMware vCenter allows local users to read and write specific fil CVE-2024-223864.7A race condition was found in the Linux kernel's drm/exynos device driver in exynos_drm_crtc_atomic_disable() function. This can result in a CVE-2024-223876.8External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticate CVE-2024-223887.8Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are pr CVE-2024-223897.2When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device. CVE-2024-22395.4The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Premium Magic Scroll module in all versions CVE-2024-223904.4Improper input validation in firmware for some Intel(R) FPGA products before version 2.9.1 may allow denial of service.CVE-2024-223919.8A heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A sp CVE-2024-223939.1Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood