{"id":"CVE-2024-21796","aliases":["EUVD-2024-19410","GHSA-c67q-c83x-f549"],"status":"published","title":"Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and...","description":"Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design \u0026 Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00195,"percentile":0.09247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-611"],"published":"2024-01-24T01:32:53Z","modified":"2026-06-17T07:10:10Z","products":[{"vendor":"dfeg","product":"electronic_deliverables_creation_support_tool"},{"vendor":"ministry of defense","product":"electronic deliverables creation support tool (construction edition)"},{"vendor":"ministry of defense","product":"electronic deliverables creation support tool (design \u0026 survey edition)"}],"references":[{"url":"https://www.dfeg.mod.go.jp/hp/contents-dfis/tool.html","tags":["x_transferred","Product"]},{"url":"https://jvn.jp/en/jp/JVN40049211/","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21796"},{"url":"https://jvn.jp/en/jp/JVN40049211"},{"url":"https://github.com/advisories/GHSA-c67q-c83x-f549"}],"sources":{"cve":[{"id":"CVE-2024-21796","description":"Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design \u0026 Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.","status":"published","published":"2024-01-24T01:32:53.509Z","modified":"2024-09-10T18:01:34.579Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:34:05.077718Z"}],"euvd":[{"id":"EUVD-2024-19410","description":"Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design \u0026 Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.","status":"published","published":"2024-01-24T01:32:53Z","modified":"2024-09-10T18:01:34Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:58.744683Z"}],"ghsa":[{"id":"GHSA-c67q-c83x-f549","title":"Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and...","description":"Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design \u0026 Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.","status":"published","published":"2024-01-24T03:31:25Z","modified":"2024-09-10T21:31:38Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:58:13.590318Z"}],"nvd":[{"id":"CVE-2024-21796","description":"Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design \u0026 Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.","status":"published","published":"2024-01-24T02:15:07.18Z","modified":"2026-06-17T07:10:10.933Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:09:32.147098Z"}]}}