CVE-2024-55925: API Security bypass through header manipulation
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55925?
CVE-2024-55925 is categorized as a high-severity vulnerability due to its potential for unauthorized access.
How do I fix CVE-2024-55925?
To fix CVE-2024-55925, ensure that the Xerox Workplace Suite server properly validates the Host header against an allowed list of hosts.
What impact does CVE-2024-55925 have on Xerox Workplace Suite?
CVE-2024-55925 could allow an attacker to bypass API restrictions and gain unauthorized access to sensitive data.
Which versions of Xerox Workplace Suite are affected by CVE-2024-55925?
CVE-2024-55925 affects all versions of Xerox Workplace Suite that do not implement proper Host header validation.
Is there a known exploitation for CVE-2024-55925?
While there may not be publicly disclosed exploits specifically for CVE-2024-55925, the nature of the vulnerability facilitates potential attacks.