CVE-2023-32635

Description

XBRL data create application version 7.0 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XBRL file, arbitrary files on the system may be read by an attacker.

Reserved 2023-05-11 | Published 2023-07-19 | Updated 2024-10-28 | Assigner jpcert

Problem types

XML external entities (XXE)

Product status

version 7.0 and earlier
affected

References

submit2.edinet-fsa.go.jp/

jvn.jp/en/jp/JVN44726469/

cve.org (CVE-2023-32635)

nvd.nist.gov (CVE-2023-32635)

Download JSON