CVE-2019-5918 - OpenCVE

Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact Complete

AV:N/AC:L/Au:N/C:P/I:N/A:C

Vendors & Products
CPE Configurations

Vendors	Products
Nablarch Project	Nablarch

Configuration 1 [-]

OR	cpe:2.3:a:nablarch_project:nablarch:5:::::::*
	cpe:2.3:a:nablarch_project:nablarch:5u1:::::::*
	cpe:2.3:a:nablarch_project:nablarch:5u13:::::::*

References

Link	Resource
http://jvn.jp/en/jp/JVN56542712/index.html	Third Party Advisory
https://nablarch.atlassian.net/projects/NAB/issues/NAB-295	Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: jpcert

Published: 2019-03-12T21:00:00

Updated: 2019-03-12T20:57:01

Reserved: 2019-01-10T00:00:00

Link: CVE-2019-5918

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-03-12T22:29:00.863

Modified: 2019-03-13T13:49:13.737

Link: CVE-2019-5918

JSON object: View

Redhat Information

No data.

CWE

CWE-611

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nablarch_project:nablarch:5:*:*:*:*:*:*:*", "matchCriteriaId": "B05E580A-3F3C-45BC-B8D0-AB89E8B7DDA8", "vulnerable": true}, {"criteria": "cpe:2.3:a:nablarch_project:nablarch:5u1:*:*:*:*:*:*:*", "matchCriteriaId": "DC8E2C1D-6523-4B2F-B936-E3E97A7C24FC", "vulnerable": true}, {"criteria": "cpe:2.3:a:nablarch_project:nablarch:5u13:*:*:*:*:*:*:*", "matchCriteriaId": "B4569B57-F7DD-40FC-AB44-0810895E921E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors."}, {"lang": "es", "value": "Nablarch 5 (5 y desde la versi\u00f3n 5u1 hasta la 5u13) permite a los atacantes remotos realizar ataques de XEE (XML External Entity) mediante vectores sin especificar."}], "id": "CVE-2019-5918", "lastModified": "2019-03-13T13:49:13.737", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 8.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 7.8, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-03-12T22:29:00.863", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "http://jvn.jp/en/jp/JVN56542712/index.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://nablarch.atlassian.net/projects/NAB/issues/NAB-295"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}