CVE-2024-55925 — API Security bypass through header manipulation

CVE-2024-55925

API Security bypass through header manipulation PUBLISHED

Description (CNA)

In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.

Affected (CNA)

Vendor / product	Versions
Xerox / Xerox Workplace Suite	affected 0 before 5.6.701.9

CWE

CWE-290

References

https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.