CVE-2023-6280

An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:52north:wps::::::::
	cpe:2.3:a:52north:wps:4.0.0:beta1::::::
	cpe:2.3:a:52north:wps:4.0.0:beta10::::::
	cpe:2.3:a:52north:wps:4.0.0:beta2::::::
	cpe:2.3:a:52north:wps:4.0.0:beta3::::::
	cpe:2.3:a:52north:wps:4.0.0:beta4::::::
	cpe:2.3:a:52north:wps:4.0.0:beta5::::::
	cpe:2.3:a:52north:wps:4.0.0:beta6::::::
	cpe:2.3:a:52north:wps:4.0.0:beta7::::::
	cpe:2.3:a:52north:wps:4.0.0:beta8::::::
	cpe:2.3:a:52north:wps:4.0.0:beta9::::::

History

No history.

Information

Published : 2023-12-19 15:15

Updated : 2024-05-17 02:33

NVD link : CVE-2023-6280

Mitre link : CVE-2023-6280

CVE.ORG link : CVE-2023-6280

JSON object : View

Products Affected

52north

wps

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2023-6280", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "cve-coordination@incibe.es"}], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}]}, "published": "2023-12-19T15:15:09.033", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps", "tags": ["Third Party Advisory"], "source": "cve-coordination@incibe.es"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad XXE (XML External Entity) en 52North WPS que afecta a versiones anteriores a la 4.0.0-beta.11. Esta vulnerabilidad permite el uso de entidades externas en su servlet WebProcessingService para que un atacante recupere archivos realizando solicitudes HTTP a la red interna."}], "lastModified": "2024-05-17T02:33:37.093", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:52north:wps:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "673124C2-F045-4759-8CAF-E7FA3B993033", "versionEndExcluding": "4.0.0"}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5133AF2F-8DDF-4DDA-88FD-3CF2549E0860"}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E94751F2-9F60-4273-A851-C864ACFA5F00"}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E99CEF0E-B714-4730-A112-E93DF41551E4"}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "129F1EA8-1211-41B4-8004-2379EF3CCF7A"}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0BE5903-85F5-4F71-B608-1B4C7DF1FF53"}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D8027A1-D84E-4C53-BD98-164A09010B50"}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D2A88B7-28B2-4877-9234-D3C3BFF28F8F"}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F3521DF-72C1-4F22-BBBF-CDE84F953B92"}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAFC6347-9AC6-48DA-94B4-8CD994BBA7F6"}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23AB9444-AB7C-48FA-8483-B272230F0AC1"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@incibe.es"}