CVE-2023-6280

HIGH

7.2

Description

An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network.

Details CVE

Score CVSS v3.17.2

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie12/19/2023

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

52north:wps

Faiblesses (CWE)

CWE-611

References

https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps(cve-coordination@incibe.es)

https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.