VulnerabilityAnalyzed

CVE-2024-55925

In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header.

HIGH 7.5EPSS 0.36%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.36% probability · 30th percentile
CISA KEV: Not listed
Weakness: CWE-290
Affected: xerox/workplace suite
Source: 10b61619-3869-496c-8a1e-f291b0e71e3f

References

https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdfVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.