CVE-2023-6280 - Vulnerability Details

Vendors	Products
52north	Wps

Link	Providers
https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-6280", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "state": "PUBLISHED", "assignerShortName": "INCIBE", "dateReserved": "2023-11-24T11:48:26.685Z", "datePublished": "2023-12-19T15:00:07.403Z", "dateUpdated": "2024-08-02T08:28:21.761Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "52North WPS", "vendor": "52North", "versions": [{"lessThan": "4.0.0-beta.11", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Angel Heredia P\u00e9rez"}], "datePublic": "2023-12-18T11:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network."}], "value": "An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2023-12-19T15:04:37.619Z"}, "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps"}], "source": {"discovery": "UNKNOWN"}, "tags": ["unsupported-when-assigned"], "title": "XML External Entity Reference on 52North WPS", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:28:21.761Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-6280 (string)

assignerOrgId : 0cbda920-cd7f-484a-8e76-bf7f4b7f4516 (string)

state : PUBLISHED (string)

assignerShortName : INCIBE (string)

dateReserved : 2023-11-24T11:48:26.685Z (string)

datePublished : 2023-12-19T15:00:07.403Z (string)

dateUpdated : 2024-08-02T08:28:21.761Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : 52North WPS (string)

vendor : 52North (string)

versions : [ »

0 : { »

lessThan : 4.0.0-beta.11 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Angel Heredia Pérez (string)

}

]

datePublic : 2023-12-18T11:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network. (string)

}

]

value : An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-611 (string)

description : CWE-611 Improper Restriction of XML External Entity Reference (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 0cbda920-cd7f-484a-8e76-bf7f4b7f4516 (string)

shortName : INCIBE (string)

dateUpdated : 2023-12-19T15:04:37.619Z (string)

}

references : [ »

0 : { »

url : https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

tags : [ »

0 : unsupported-when-assigned (string)

]

title : XML External Entity Reference on 52North WPS (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T08:28:21.761Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:52north:wps:*:*:*:*:*:*:*:*", "matchCriteriaId": "673124C2-F045-4759-8CAF-E7FA3B993033", "versionEndExcluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "5133AF2F-8DDF-4DDA-88FD-3CF2549E0860", "vulnerable": true}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta10:*:*:*:*:*:*", "matchCriteriaId": "E94751F2-9F60-4273-A851-C864ACFA5F00", "vulnerable": true}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "E99CEF0E-B714-4730-A112-E93DF41551E4", "vulnerable": true}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "129F1EA8-1211-41B4-8004-2379EF3CCF7A", "vulnerable": true}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "A0BE5903-85F5-4F71-B608-1B4C7DF1FF53", "vulnerable": true}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta5:*:*:*:*:*:*", "matchCriteriaId": "9D8027A1-D84E-4C53-BD98-164A09010B50", "vulnerable": true}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta6:*:*:*:*:*:*", "matchCriteriaId": "3D2A88B7-28B2-4877-9234-D3C3BFF28F8F", "vulnerable": true}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta7:*:*:*:*:*:*", "matchCriteriaId": "6F3521DF-72C1-4F22-BBBF-CDE84F953B92", "vulnerable": true}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta8:*:*:*:*:*:*", "matchCriteriaId": "DAFC6347-9AC6-48DA-94B4-8CD994BBA7F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:52north:wps:4.0.0:beta9:*:*:*:*:*:*", "matchCriteriaId": "23AB9444-AB7C-48FA-8483-B272230F0AC1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "cve-coordination@incibe.es", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad XXE (XML External Entity) en 52North WPS que afecta a versiones anteriores a la 4.0.0-beta.11. Esta vulnerabilidad permite el uso de entidades externas en su servlet WebProcessingService para que un atacante recupere archivos realizando solicitudes HTTP a la red interna."}], "id": "CVE-2023-6280", "lastModified": "2024-11-21T08:43:31.727", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "cve-coordination@incibe.es", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-19T15:15:09.033", "references": [{"source": "cve-coordination@incibe.es", "tags": ["Third Party Advisory"], "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps"}], "sourceIdentifier": "cve-coordination@incibe.es", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "cve-coordination@incibe.es", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:52north:wps:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 673124C2-F045-4759-8CAF-E7FA3B993033 (string)

versionEndExcluding : 4.0.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:52north:wps:4.0.0:beta1:*:*:*:*:*:* (string)

matchCriteriaId : 5133AF2F-8DDF-4DDA-88FD-3CF2549E0860 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:52north:wps:4.0.0:beta10:*:*:*:*:*:* (string)

matchCriteriaId : E94751F2-9F60-4273-A851-C864ACFA5F00 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:52north:wps:4.0.0:beta2:*:*:*:*:*:* (string)

matchCriteriaId : E99CEF0E-B714-4730-A112-E93DF41551E4 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:52north:wps:4.0.0:beta3:*:*:*:*:*:* (string)

matchCriteriaId : 129F1EA8-1211-41B4-8004-2379EF3CCF7A (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:52north:wps:4.0.0:beta4:*:*:*:*:*:* (string)

matchCriteriaId : A0BE5903-85F5-4F71-B608-1B4C7DF1FF53 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:52north:wps:4.0.0:beta5:*:*:*:*:*:* (string)

matchCriteriaId : 9D8027A1-D84E-4C53-BD98-164A09010B50 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:52north:wps:4.0.0:beta6:*:*:*:*:*:* (string)

matchCriteriaId : 3D2A88B7-28B2-4877-9234-D3C3BFF28F8F (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:52north:wps:4.0.0:beta7:*:*:*:*:*:* (string)

matchCriteriaId : 6F3521DF-72C1-4F22-BBBF-CDE84F953B92 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:52north:wps:4.0.0:beta8:*:*:*:*:*:* (string)

matchCriteriaId : DAFC6347-9AC6-48DA-94B4-8CD994BBA7F6 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:52north:wps:4.0.0:beta9:*:*:*:*:*:* (string)

matchCriteriaId : 23AB9444-AB7C-48FA-8483-B272230F0AC1 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ »

0 : { »

sourceIdentifier : cve-coordination@incibe.es (string)

tags : [ »

0 : unsupported-when-assigned (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network. (string)

}

1 : { »

lang : es (string)

value : Se ha detectado una vulnerabilidad XXE (XML External Entity) en 52North WPS que afecta a versiones anteriores a la 4.0.0-beta.11. Esta vulnerabilidad permite el uso de entidades externas en su servlet WebProcessingService para que un atacante recupere archivos realizando solicitudes HTTP a la red interna. (string)

}

]

id : CVE-2023-6280 (string)

lastModified : 2024-11-21T08:43:31.727 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 2.7 (number)

source : cve-coordination@incibe.es (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-12-19T15:15:09.033 (string)

references : [ »

0 : { »

source : cve-coordination@incibe.es (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps (string)

}

]

sourceIdentifier : cve-coordination@incibe.es (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-611 (string)

}

]

source : cve-coordination@incibe.es (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object