CVE-2023-6280 HIGH

CVE-2023-6280: XML External Entity Reference on 52North WPS

Vendor 52North

Product 52North WPS

Weakness CWE-611 · XXE

Published December 19, 2023

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

7.2/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

What the vulnerability does

01Description

An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network.

Key dates

02Disclosure timeline

December 19, 2023 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-6280 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/611.html

Related vulnerabilities

04Related CVE

CVE-2019-18227 CVE-2017-3206 The Action Message Format (AMF3) deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages CVE-2020-7032 Avaya WebLM Improper Restriction of XML External Entity Reference CVE-2025-49539 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) CVE-2025-31039 WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability