Weaknesses in the Xerox Print Orchestration Product allow remote code execution

Xerox has addressed critical security vulnerabilities in its FreeFlow Core, specifically Path Traversal and XML External Entity (XXE) injection flaws that could allow unauthenticated remote code execution. These vulnerabilities posed significant risks, enabling potential attackers to exploit the system without requiring any form of authentication. By successfully executing these attacks, malicious actors could gain unauthorised access to sensitive data and execute arbitrary code, jeopardising the integrity and confidentiality of the affected systems. The timely patching of these flaws underscores Xerox’s commitment to maintaining robust security measures within its Print Orchestration Product.

The vulnerabilities were highlighted in a recent post by SecurityWeek, drawing attention to the importance of addressing such security issues in enterprise-level software. Users of Xerox FreeFlow Core are strongly encouraged to update their systems to the latest version to mitigate the risks associated with these vulnerabilities. By implementing these patches, Xerox aims to enhance the overall security posture of its products and protect users from potential cyber threats. This proactive approach reflects the company’s dedication to safeguarding its clients’ operations and ensuring a secure printing environment.