Remote Code Execution Vulnerability in Xerox FreeFlow Core
CVE-2024-47556

9.8CRITICAL

Key Information:

Vendor

Xerox
Status
Freeflow Core
Vendor
CVE Published:
7 October 2024

What is CVE-2024-47556?

The vulnerability identified presents the possibility of pre-authentication remote code execution through a path traversal technique. This security flaw enables unauthorized access to system files and executing commands on the server, posing a serious risk to organizations using the affected product. The improper validation of user-supplied input allows attackers to manipulate file paths, potentially leading to a full compromise of the system hosting Xerox FreeFlow Core. Companies relying on this software should promptly apply security patches provided in the relevant security bulletin to mitigate the risk.

References

https://securitydocs.business.xerox.com/wp-content/upload...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.