CVE-2024-55925

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
Xerox	Xerox Workplace Suite	< 5.6.701.9

References

https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdfVendor Advisory

Timeline

Published: Jan 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-559269.8A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipul CVE-2024-559277.5A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attacker CVE-2024-559287.5Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept o CVE-2024-559295.3A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent CVE-2024-559309.8Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files CVE-2024-559316.5Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised. The CVE-2024-55949.1OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected ar CVE-2024-559456.5TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionalit CVE-2024-559468.7Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data CVE-2024-559478.8Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH acce CVE-2024-559488.2Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the CVE-2024-559499.3MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation i