CVE-2025-8355

Published Aug 8, 2025

Last updated 2 days ago

Xerox FreeFlow Core

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-8355 is an XML External Entity (XXE) processing flaw found in Xerox FreeFlow Core version 8.0.4. The vulnerability stems from improper handling of XML input, which allows injection of external entities. An attacker can exploit this vulnerability by crafting malicious XML containing references to internal URLs, leading to a Server-Side Request Forgery (SSRF) attack. This enables the attacker to force the server to make unintended requests to internal or external resources, potentially exposing sensitive information or accessing restricted network services. Xerox has released a security update in FreeFlow Core version 8.0.5 to address this vulnerability.

Description: In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).
Source: 10b61619-3869-496c-8a1e-f291b0e71e3f
NVD status: Analyzed
Products: freeflow_core

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity: HIGH

Weaknesses

10b61619-3869-496c-8a1e-f291b0e71e3f: CWE-611

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:xerox:freeflow_core:8.0.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DE1A3551-53C9-4604-953C-335A038BE68D"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.