cve/2024/CVE-2024-55925.md

### [CVE-2024-55925](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55925)
![](https://img.shields.io/static/v1?label=Product&message=Xerox%20Workplace%20Suite&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%205.6.701.9%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brighgreen)

### Description

In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/Orange-Cyberdefense/CVE-repository
Update CVE sources 2025-09-29 16:08 2025-09-29 16:08:36 +00:00			`### [CVE-2024-55925](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55925)`
			`![](https://img.shields.io/static/v1?label=Product&message=Xerox%20Workplace%20Suite&color=blue)`
			`![](https://img.shields.io/static/v1?label=Version&message=0%3C%205.6.701.9%20&color=brighgreen)`
			`![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brighgreen)`

			`### Description`

			`In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.`

			`### POC`

			`#### Reference`
			`No PoCs from references.`

			`#### Github`
			`- https://github.com/Orange-Cyberdefense/CVE-repository`