CVE-2025-8355
BaseFortify
Publication date: 2025-08-08
Last updated on: 2025-08-14
Assigner: Xerox
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xerox | freeflow_core | 8.0.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Xerox FreeFlow Core version 8.0.4 involves improper handling of XML input that allows an attacker to inject external entities. By crafting malicious XML containing references to internal URLs, the attacker can cause the system to perform Server-Side Request Forgery (SSRF), making the server send unauthorized requests to internal resources.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to make the vulnerable server send unauthorized requests to internal systems or services. This can lead to unauthorized access to internal resources, potential data exposure, or further exploitation within the internal network.