Vulnerability in Xerox Workplace Suite
CVE-2024-55925
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.
EPSS: 0.004 (28.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Xerox Workplace_suite
- Xerox Workplace Suite — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 10b61619-3869-496c-8a1e-f291b0e71e3f (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-55925?
- CVE-2024-55925 is a high-severity vulnerability in Xerox Workplace Suite, classified under Authentication Bypass by Spoofing. CVSS score: 7.5/10. Published 2025-01-23.
- How severe is CVE-2024-55925?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2024-55925 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.