CVE-2024-55925
API Security bypass through header manipulation
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
23 Jan 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Xerox · Xerox Workplace SuiteWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →