## Summary
An XML External Entity (XXE) vulnerability in Xerox FreeFlow Core allows a malicious user to trigger Server-Side Request Forgery (SSRF) by submitting crafted XML containing external entity references. The issue affects Xerox FreeFlow Core versions up to and including 8.0.7.
## Technical Details
- Vulnerability type: XXE (CWE-611)
- Attack vector: NETWORK
- Mechanism: crafted XML input with malicious external entity references can cause the server to make outbound requests (SSRF).
- CVSS (provided): 7.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
## Affected
- Xerox FreeFlow Core versions < 8.1.0 (i.e., up to and including 8.0.7)
## Impact
- High confidentiality impact (C:H) due to SSRF behavior enabled by XXE
- No integrity or availability impact indicated in the provided metrics (I:N, A:N)
- Attack prerequisites: none beyond network access (per PR:N, UI:N)
## Mitigation
1. Upgrade Xerox FreeFlow Core to 8.1.0 (or later) using the software available from Xerox Support: https://www.support.xerox.com/en-us/product/core/downloads.
2. If immediate upgrade is not possible, restrict network access to the affected service endpoints to reduce exposure (based on AV:N).
3. Ensure any XML ingestion endpoints validate/limit XML features (e.g., disable external entity resolution) as a compensating control, consistent with XXE risk.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-611