Xerox FreeFlow Core Server-Side Request Forgery Vulnerability via XML External Entity Injection

A vulnerability in Xerox FreeFlow Core version 8.0.4 allows for Server-Side Request Forgery (SSRF) through improper handling of XML input, which enables the injection of external entities. An attacker can create malicious XML that references internal URLs, leading to unauthorized requests being made from the server.

Impact

Exploitation of this vulnerability allows for Server-Side Request Forgery, where an attacker can make the server send requests to internal resources, potentially leading to further exploitation or information disclosure.

Remediation

Users are advised to upgrade to Xerox FreeFlow Core version 8.0.5, available through the Xerox support website.