CVE-2023-6280

HIGH

7.2

Descripcion

An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network.

Detalles CVE

Puntuacion CVSS v3.17.2

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado12/19/2023

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

52north:wps

Debilidades (CWE)

CWE-611

Referencias

https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps(cve-coordination@incibe.es)

https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.