CVE-2024-55926

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-434

Affected software

Vendor	Product	Versions
Xerox	Xerox Workplace Suite	< 5.6.701.9

References

https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdfVendor Advisory

Timeline

Published: Jan 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-559277.5A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attacker CVE-2024-559287.5Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept o CVE-2024-559295.3A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent CVE-2024-559309.8Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files CVE-2024-559316.5Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised. The CVE-2024-55949.1OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected ar CVE-2024-559456.5TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionalit CVE-2024-559468.7Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data CVE-2024-559478.8Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH acce CVE-2024-559488.2Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the CVE-2024-559499.3MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation i CVE-2024-55955.4The Essential Blocks WordPress plugin before 4.7.0 does not validate and escape some of its block options before outputting them back in a