Security readout for executives and security teams
This is an old CSRF issue in Xythos document-management products. If a user is already authenticated, an attacker could potentially cause actions to run as another user through crafted workflow names or HTTP headers. The sources name fixed XEDM versions, but do not provide CVSS, active exploitation evidence, or complete product coverage. Exposure is most likely in legacy environments still running Xythos Enterprise Document Manager, Xythos Digital Locker, or possibly WebFile Server. Internet-facing portals and deployments with privileged document workflows have higher business risk. Prioritize this if any legacy Xythos system is still used for sensitive documents or exposed beyond trusted networks. Otherwise, handle through legacy application risk review and retirement planning. Mitigation focus: Inventory Xythos Enterprise Document Manager, Digital Locker, and WebFile Server deployments.; Upgrade XEDM to 5.0.25.8, 6.0.46.1, or later supported vendor guidance.; For XDL, check vendor guidance for the same affected version ranges..
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2007-3255 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- xedm-multiple-csrf(35084)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.