CVE-2023-42132

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-02 · updated 2026-06-17
Weakness: CWE-611

Description

FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

Affected products

Ministry of Health, Labour and Welfare FD Application: through 9.01

References

https://jvn.jp/en/jp/JVN39596244/
https://web.fd-shinsei.mhlw.go.jp/download/software/index.html
https://jvn.jp/en/jp/JVN39596244/
https://web.fd-shinsei.mhlw.go.jp/download/software/index.html

Get alerted when CVE-2023-42132 or the next vulnerability affects your stack