PT-2025-3154 · Xerox · Xerox Workplace Suite

Published 2025-01-23 · Updated 2026-02-28 · CVE-2024-55926

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xerox Workplace Suite versions prior to 5.6.701.9

Description A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data.

Recommendations For versions prior to 5.6.701.9, update to version 5.6.701.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation. Avoid using crafted headers until the issue is resolved.

Fix

Path traversal

Unrestricted File Upload

Weakness Enumeration

CWE-22

CWE-434

Related Identifiers

BDU:2025-01852

CVE-2024-55926

Affected Products

Xerox Workplace Suite

References · 12

• https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55926 · Security Note
• https://bdu.fstec.ru/vul/2025-01852 · Security Note
• https://t.me/cvenotify/112325 · Telegram Post
• https://t.me/cvenotify/108662 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1882518617243226154 · Twitter Post
• https://twitter.com/CVEnew/status/1882501633898332379 · Twitter Post
• https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-Workplace-Suite%C2%AE.pdf · Note
• https://t.me/cveNotify/153618 · Telegram Post
• https://t.me/cvedetector/16224 · Telegram Post
• https://t.me/cvenotify/108962 · Telegram Post