Xerox ≫ Freeflow Core

In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system.

In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).

Pre-Auth RCE via Path Traversal

Pre-Auth RCE via Path Traversal

Authenticated RCE via Path Traversal

Authenticated RCE via Path Traversal

Missing Authentication - User & System Configuration