CVE-2024-55928

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets without encryption

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
Xerox	Xerox Workplace Suite	< 5.6.701.9

References

https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdfVendor Advisory

Timeline

Published: Jan 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-559295.3A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent CVE-2024-559309.8Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files CVE-2024-559316.5Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised. The CVE-2024-55949.1OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected ar CVE-2024-559456.5TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionalit CVE-2024-559468.7Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data CVE-2024-559478.8Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH acce CVE-2024-559488.2Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the CVE-2024-559499.3MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation i CVE-2024-55955.4The Essential Blocks WordPress plugin before 4.7.0 does not validate and escape some of its block options before outputting them back in a CVE-2024-559508.6Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.216, Tabby terminal emulator contains overly permissive e CVE-2024-559514.8Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are a