Vulnerability feed

Executive summary

A vulnerability in the Electronic delivery item Inspection Support System, provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism, allows files in the application's installation folder to be tampered with. The advisory says this can lead to arbitrary code execution, and it rates the flaw as high severity. The recommended action is to update to the latest version or use the latest installer provided by the developer.

Technical summary

The flaw is classified as incorrect default permissions (CWE-276), which is an improper file access permission issue. The advisory describes it as a local attack requiring low privileges and no user interaction, and it gives CVSS 4.0 base score 8.5 and CVSS 3.0 base score 7.8. Affected versions are Ver.4.0.36 and earlier, and the advisory does not state a specific fixed version, only that users should update to the latest version or use the latest installer. Workarounds are not stated, and no detection guidance or evidence of exploitation in the wild is given in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from jvn.jp/en/jp/JVN75668103

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Attack requirements

None

Privileges required

Low

User interaction

None

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

Ministry of Land, Infrastructure, Transport and Tourism, JapanMinistry of Land, Infrastructure, Transport and Tourism, Japan Electronic delivery item Inspection Support System