CVE-2024-55926CWE-22CWE-434

Arbitrary file upload, deletion and read through header manipulation

High · published January 23, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00424 · 35.6th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-01-23T17:12Z
EPSS history
Timeline
  • 23 JAN 17:12Z
    Arbitrary file upload, deletion and read through header manipulation
    cvelistv5