{"id":"CVE-2023-6280","summary":"XML External Entity Reference on 52North WPS","details":"An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network.","modified":"2026-10-28T02:30:40.489850283Z","published":"2023-12-19T15:00:07.403Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"fixed":"4.0.0-beta.11"}]}]}],"cna_assigner":"INCIBE","cwe_ids":["CWE-611"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6280.json"},"references":[{"type":"WEB","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6280.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6280"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/52north/wps","events":[{"introduced":"0"},{"fixed":"9844637e75a7ad86906a0976e1b1c96f1fe0b013"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"4.0.0-beta.11"}],"source":"DESCRIPTION"}]}}],"versions":["v4.0.0-beta.10","v4.0.0-beta.9","v4.0.0-beta.8","v4.0.0-beta.7","v4.0.0-beta.6","v4.0.0-beta.5","v4.0.0-beta.4","v4.0.0-beta.3","v4.0.0-beta.2","v4.0.0-beta.1","WPS-3.3.0","52n-wps-parent-3.3.0","WPS-3.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6280.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L"}]}