PT-2025-32364 · Xerox · Xerox Freeflow Core

Publicado 2025-08-08 · Atualizado 2025-08-29 · CVE-2025-8355

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xerox FreeFlow Core version 8.0.4

Description Improper handling of XML input allows injection of external entities, leading to a Server-Side Request Forgery (SSRF). An attacker can craft malicious XML containing references to internal URLs to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2025-13431

CVE-2025-8355

Produtos afetados

Xerox Freeflow Core

Referências · 34

• https://twitter.com/CVEnew/status/1953848310030016708 · Publicação no Twitter
• https://t.me/CVEtracker/29510 · Publicação no Telegram
• https://t.me/cKure/16128 · Publicação no Telegram
• https://twitter.com/f1tym1/status/1954867686464225749 · Publicação no Twitter
• https://twitter.com/autumn_good_35/status/1955639425393934409 · Publicação no Twitter
• https://twitter.com/Horizon3ai/status/1956448769605869747 · Publicação no Twitter
• https://t.me/purp_sec/1029 · Publicação no Telegram
• https://reddit.com/r/CVEWatch/comments/1mqtevk/top_10_trending_cves_15082025 · Publicação no Reddit
• https://t.me/CyberSecurityTechnologies/12308 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2025-13431 · Nota de Segurança
• https://twitter.com/Horizon3ai/status/1955636847431888960 · Publicação no Twitter
• https://twitter.com/Horizon3Attack/status/1955627015521865742 · Publicação no Twitter
• https://twitter.com/tpx_Security/status/1956357534605811986 · Publicação no Twitter
• https://twitter.com/TweetThreatNews/status/1955044767491928494 · Publicação no Twitter
• https://twitter.com/Cloudforce_One/status/1955717958040478147 · Publicação no Twitter