CVE-2006-6438

Severity: medium (CVSS 4.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-12-10 · updated 2026-06-16

Description

Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 leaves sensitive user data in http.log after an Immediate Image Overwrite (IIO), which allows local users to obtain the data by reading the http.log file.

Affected products

Xerox Workcentre 232: all versions
Xerox Workcentre 238: all versions
Xerox Workcentre 245: all versions
Xerox Workcentre 255: all versions
Xerox Workcentre 265: all versions
Xerox Workcentre 275: all versions

References

http://secunia.com/advisories/23265
http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf
http://secunia.com/advisories/23265
http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf

Get alerted when CVE-2006-6438 or the next vulnerability affects your stack