An unauthenticated XXE vulnerability in Xerox FreeFlow Core allows remote attackers to conduct SSRF attacks, potentially leading to unauthorized internal network access.

This vulnerability resides in the XML parsing logic of the application, which improperly restricts external entity references. An unauthenticated attacker can exploit this by submitting crafted XML input to trigger SSRF, allowing them to make unauthorized requests from the server to internal or external resources.

The ability to perform SSRF allows attackers to probe internal network segments, bypass firewall restrictions, or interact with sensitive internal services that are not exposed to the public internet. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk of internal data exposure and unauthorized access to backend infrastructure.

Immediate Action: Upgrade to Xerox FreeFlow Core version 8.1.0 or later as recommended by the vendor.

Proactive Monitoring: Review web server and application logs for unusual XML payloads or unexpected outbound network connections originating from the FreeFlow Core server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect XML traffic and block requests containing suspicious DOCTYPE or entity declarations.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to internal network security by providing an entry point for lateral movement. Administrators should prioritize the deployment of the 8.1.0 update immediately to remediate the underlying XML parsing flaw and prevent potential SSRF exploitation.