CVE-2024-55928
Published: 23 January 2025
Summary
CVE-2024-55928 is a medium-severity Cleartext Storage of Sensitive Information (CWE-312) vulnerability in Xerox Workplace Suite. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 36.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SC-28 (Protection of Information at Rest).
Deeper analysis
CVE-2024-55928 is a vulnerability in Xerox Workplace Suite that exposes sensitive secrets in clear text, both locally and remotely, allowing attackers to intercept or access them without encryption. Classified under CWE-312 (Cleartext Storage of Sensitive Information), it carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting medium severity primarily due to high confidentiality impact.
The vulnerability can be exploited by attackers with low privileges, such as authenticated users, over the network with low complexity and no user interaction required. Successful exploitation enables high-impact disclosure of sensitive secrets, potentially compromising confidentiality without affecting integrity or availability.
Mitigation details are provided in the Xerox Security Bulletin XRX25-002, available at https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf. The CVE was published on 2025-01-23T18:15:32.100.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52852
Vulnerability details
Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets without encryption
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Cleartext storage of sensitive secrets directly enables discovery of unsecured credentials.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates cryptographic protection of sensitive information at rest, preventing local cleartext access to exposed secrets in Xerox Workplace Suite.
Requires cryptographic protection for the confidentiality and integrity of transmitted information, mitigating remote interception of cleartext secrets.
Mandates encrypted storage and transmission of sensitive authenticators, directly addressing cleartext exposure of secrets that function as credentials or keys.