XML external entity injection in TIS Inc. Nablarch 5
Priority MEDIUM 43CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.
Why it matters now
EPSS 0.01863 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIS Inc. | Nablarch 5 | Nablarch 5, and 5u1 to 5u13 | — | No fix listed | CNA |
- Nablarch 5 VendorTIS Inc. Affected Nablarch 5, and 5u1 to 5u13 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nablarch_project:nablarch:5:*:*:*:*:*:*:* | 5 | Vulnerable | Nablarch Project |
| cpe:2.3:a:nablarch_project:nablarch:5u1:*:*:*:*:*:*:* | 5u1 | Vulnerable | Nablarch Project |
| cpe:2.3:a:nablarch_project:nablarch:5u13:*:*:*:*:*:*:* | 5u13 | Vulnerable | Nablarch Project |
- cpe:2.3:a:nablarch_project:nablarch:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Nablarch Project
- cpe:2.3:a:nablarch_project:nablarch:5u1:*:*:*:*:*:*:* Versions 5u1 Vulnerable ·Nablarch Project
- cpe:2.3:a:nablarch_project:nablarch:5u13:*:*:*:*:*:*:* Versions 5u13 Vulnerable ·Nablarch Project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5918
- 2026-10-03 Alias added: GHSA-qm84-429w-3353
References
More TIS Inc. vulnerabilities
- TI-2007-00196 Buffer overflow in the cmd_usr function in ftp-gw in TIS Internet Firewall Toolkit (FWTK)… CVSS 2.0HIGH 10.0
- TI-2019-04215 Broken or risky cryptographic algorithm in TIS Inc. Nablarch 5 CVSS 3.0CRITICAL 9.1
- TI-2000-00940 Format string vulnerability in x-gw in TIS Firewall Toolkit (FWTK) allows local users to… CVSS 2.0HIGH 7.2
Sources
- CVE-2019-5918 · CVE Program
- CVE-2019-5918 · NVD
- FIRST EPSS
- GHSA-qm84-429w-3353 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences