2 lines
2.7 KiB
JSON
2 lines
2.7 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"FreeFlow Core","vendor":"Xerox","versions":[{"lessThanOrEqual":"8.0.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"10b61619-3869-496c-8a1e-f291b0e71e3f"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:xerox:freeflow_core:*:*:*:*:*:*:*:*","matchCriteriaId":"BB016BFC-2C5B-4CFA-BC3C-B5A9DBF893F1","versionEndExcluding":"8.1.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references.\n\nThis issue affects Xerox FreeFlow Core versions up to and including 8.0.7. \n\nPlease consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads"},{"lang":"es","value":"Una vulnerabilidad de Entidad Externa XML (XXE) permite a un usuario malintencionado realizar una falsificación de petición del lado del servidor (SSRF) a través de una entrada XML manipulada que contiene referencias a entidades externas maliciosas.\n\nEste problema afecta a las versiones de Xerox FreeFlow Core hasta la 8.0.7 inclusive.\n\nConsidere actualizar a la versión 8.1.0 de FreeFlow Core a través del software disponible en - https://www.support.xerox.com/en-us/product/core/downloads"}],"id":"CVE-2026-2252","lastModified":"2026-06-17T10:30:38.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"10b61619-3869-496c-8a1e-f291b0e71e3f","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-2252","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-03T19:27:58.048822Z","version":"2.0.3"}}]},"published":"2026-02-27T09:16:17.130","references":[{"source":"10b61619-3869-496c-8a1e-f291b0e71e3f","tags":["Vendor Advisory"],"url":"https://securitydocs.business.xerox.com/wp-content/uploads/2026/02/Xerox-Security-Bulletin-026-005-for-Xerox-Freeflow-Core.pdf"}],"sourceIdentifier":"10b61619-3869-496c-8a1e-f291b0e71e3f","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"},{"lang":"en","value":"CWE-918"}],"source":"10b61619-3869-496c-8a1e-f291b0e71e3f","type":"Secondary"}]}
|