Описание
API Security bypass through header manipulation
API Security bypass through header manipulation
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2024-55925
- https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-Workplace-Suite%C2%AE.pdf
- https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
Связанные уязвимости
CVSS3: 7.5
nvd
около 1 года назад
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.
CVSS3: 6.5
fstec
около 1 года назад
Уязвимость интерфейса сервера управления печатью Xerox Workplace Suite, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации