CVE-2023-6280

HIGH

7.2

Description

An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network.

CVE Details

CVSS v3.1 Score7.2

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published12/19/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

52north:wps

Weaknesses (CWE)

CWE-611

References

https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps(cve-coordination@incibe.es)

https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.