CVE-2024-21765

MEDIUM 5.5CVE-2024-21765 · Published 24/01/2024 · updated 17/06/2026

In short

CVE-2024-21765 is a MEDIUM (CVSS 5.5) vulnerability affecting electronic delivery check system (cals-ed), electronic delivery item inspection support system (cals-ed).
Chance of exploitation in the next 30 days (EPSS): 0.23%, higher than 14.2% of all vulnerabilities.
Fix: update to 11.0.0, 13.0.0, 19.0.0 or later.

Package	Affected versions	Patched versions
electronic delivery check system cals-ed	`< 11.0.0< 13.0.0< 19.0.0`	`11.0.013.0.019.0.0`
electronic delivery item inspection support system cals-ed	`≤ 4.0.31`	No fix yet

Description

Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.

References

cals-ed.go.jp/checksys-release-20231130 · Release Notes
jvn.jp/en/jp/JVN77736613 · Third Party Advisory
ysk.nilim.go.jp/cals · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free