PT-2025-32364 · Xerox · Xerox Freeflow Core
Published
2025-08-08
·
Updated
2025-08-15
·
CVE-2025-8355
CVSS v3.1
7.5
7.5
High
| Base vector | Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Xerox FreeFlow Core version 8.0.4
Description:
Improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, resulting in a Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) occurs when an attacker can cause the server to make requests to unintended locations.
Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
XXE
Weakness Enumeration
Related Identifiers
CVE-2025-8355
Affected Products
Xerox Freeflow Core
References · 27
- https://nvd.nist.gov/vuln/detail/CVE-2025-8355 · Security Note
- https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf · Vendor Advisory
- https://t.me/purp_sec/1029 · Telegram Post
- https://twitter.com/the_yellow_fall/status/1954727297870946460 · Twitter Post
- https://twitter.com/TweetThreatNews/status/1954890749452878122 · Twitter Post
- https://twitter.com/CVEnew/status/1953848310030016708 · Twitter Post
- https://twitter.com/wvipersg/status/1954858789020008797 · Twitter Post
- https://twitter.com/dailytechonx/status/1954996242062213540 · Twitter Post
- https://twitter.com/Horizon3Attack/status/1955627015521865742 · Twitter Post
- https://twitter.com/PaxionCyber/status/1954896866841133371 · Twitter Post
- https://twitter.com/cracbot/status/1955585191293915522 · Twitter Post
- https://reddit.com/r/CVEWatch/comments/1mpwdks/top_10_trending_cves_14082025 · Reddit Post
- https://twitter.com/CCBalert/status/1956009981574021229 · Twitter Post
- https://t.me/cKure/16128 · Telegram Post
- https://twitter.com/ET_Labs/status/1955737270692274540 · Twitter Post