by Kastro
Paper/Archive/CVE-2024-55926

CVE-2024-55926

Xerox Xerox Workplace Suite — Arbitrary file upload, deletion and read through header manipulation

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 38.0.380 × 207.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data

Affected

ProductAffectedFixed inSource
Xerox Workplace Suite< 5.6.701.95.6.701.9CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Xerox (CNA)7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refsecuritydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf