What’s Vulnerable › Vulnerabilities
CVE-2024-55925: API Security bypass through header manipulation
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-01-23 · updated 2026-06-17
- Weakness: CWE-290
Description
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.
Affected products
- Xerox Workplace Suite: before 5.6.701.9 — fixed in 5.6.701.9
How to fix
Upgrade to a fixed version: Xerox Workplace Suite 5.6.701.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-55925 or the next vulnerability affects your stack