{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-22377", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "dateUpdated": "2024-08-02T10:07:06.571Z", "dateReserved": "2022-12-28T00:00:00", "datePublished": "2023-02-15T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-02-15T00:00:00"}, "descriptions": [{"lang": "en", "value": "Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability is exploited, an attacker may obtain an arbitrary file which meets a certain condition by reading a specially crafted XML file."}], "affected": [{"vendor": "FUJITSU LIMITED", "product": "tsClinical Define.xml Generator and tsClinical Metadata Desktop Tools", "versions": [{"version": "tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0", "status": "affected"}]}], "references": [{"url": "https://github.com/tsClinical/tsc-desktop/security/advisories"}, {"url": "https://jvn.jp/en/jp/JVN00712821/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Improper restriction of XML external entity reference"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:07:06.571Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/tsClinical/tsc-desktop/security/advisories", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN00712821/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fujitsu:tsclinical_define.xml_generator:*:*:*:*:*:*:*:*", "matchCriteriaId": "7CD969AE-0F5A-47AA-AEC5-D09799E4CB84", "versionEndIncluding": "1.4.0", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fujitsu:tsclinical_metadata_desktop_tools:*:*:*:*:*:*:*:*", "matchCriteriaId": "86E0D282-DB0B-4D98-903F-D491E88CE0A5", "versionEndExcluding": "1.1.1", "versionStartIncluding": "1.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability is exploited, an attacker may obtain an arbitrary file which meets a certain condition by reading a specially crafted XML file."}, {"lang": "es", "value": "Existe una restricci\u00f3n inadecuada de la vulnerabilidad de referencia de entidad externa XML (XXE) en tsClinical Define.xml Generator todas las versiones (v1.0.0 a v1.4.0) y tsClinical Metadata Desktop Tools versi\u00f3n 1.0.3 a versi\u00f3n 1.1.0. Si se aprovecha esta vulnerabilidad, un atacante puede obtener un archivo arbitrario que cumpla una determinada condici\u00f3n leyendo un archivo XML especialmente manipulado."}], "id": "CVE-2023-22377", "lastModified": "2024-11-21T07:44:39.703", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-02-15T01:15:10.623", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/tsClinical/tsc-desktop/security/advisories"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN00712821/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/tsClinical/tsc-desktop/security/advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN00712821/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "[email protected]", "type": "Primary"}]}

{}