Broken or risky cryptographic algorithm in TIS Inc. Nablarch 5
Priority MEDIUM 41CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-327.
Summary
An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors.
Why it matters now
EPSS 0.00953 61st percentileScored 2026-11-07
Fix Fixed com.nablarch.framework:nablarch-fw-web (Maven): 1.5.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIS Inc. | Nablarch 5 | Nablarch 5, and 5u1 to 5u13 | — | No fix listed | CNA |
| — | com.nablarch.framework:nablarch-fw-web (Maven) | before 1.5.1 | 1.5.1 | Patch available | GHSA-hmx6-gc2p-5p82 |
- Nablarch 5 VendorTIS Inc. Affected Nablarch 5, and 5u1 to 5u13 Fixed in — No fix listed CNA
- com.nablarch.framework:nablarch-fw-web (Maven) Vendor— Affected before 1.5.1 Fixed in 1.5.1 Patch available GHSA-hmx6-gc2p-5p82
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nablarch_project:nablarch:5:*:*:*:*:*:*:* | 5 | Vulnerable | Nablarch Project |
| cpe:2.3:a:nablarch_project:nablarch:5u1:*:*:*:*:*:*:* | 5u1 | Vulnerable | Nablarch Project |
| cpe:2.3:a:nablarch_project:nablarch:5u13:*:*:*:*:*:*:* | 5u13 | Vulnerable | Nablarch Project |
- cpe:2.3:a:nablarch_project:nablarch:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Nablarch Project
- cpe:2.3:a:nablarch_project:nablarch:5u1:*:*:*:*:*:*:* Versions 5u1 Vulnerable ·Nablarch Project
- cpe:2.3:a:nablarch_project:nablarch:5u13:*:*:*:*:*:*:* Versions 5u13 Vulnerable ·Nablarch Project
Remediation
- Fix · GHSA-hmx6-gc2p-5p82 com.nablarch.framework:nablarch-fw-web (Maven) Fixed in 1.5.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5919
- 2026-10-03 Alias added: GHSA-hmx6-gc2p-5p82
References
More TIS Inc. vulnerabilities
- TI-2007-00196 Buffer overflow in the cmd_usr function in ftp-gw in TIS Internet Firewall Toolkit (FWTK)… CVSS 2.0HIGH 10.0
- TI-2019-04214 XML external entity injection in TIS Inc. Nablarch 5 CVSS 3.0CRITICAL 9.1
- TI-2000-00940 Format string vulnerability in x-gw in TIS Firewall Toolkit (FWTK) allows local users to… CVSS 2.0HIGH 7.2
Sources
- CVE-2019-5919 · CVE Program
- CVE-2019-5919 · NVD
- FIRST EPSS
- GHSA-hmx6-gc2p-5p82 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences