BaseFortify

Publication date: 2025-10-27

Last updated on: 2025-10-31

Assigner: MITRE

Description

An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not implement CSRF protections. An attacker who social engineers a valid user into clicking a malicious link or visiting a malicious website may be able to submit requests to the Job Status Service without the user's knowledge.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-27

Last Modified

2025-10-31

Generated

2026-07-06

AI Q&A

2025-10-27

EPSS Evaluated

2026-07-05

NVD

CVE-2025-54969

EUVD

EUVD-2025-36206

Affected Vendors & Products

Vendor	Product	Version / Range
baesystems	socet_gxp	to 4.6.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in BAE SOCET GXP before version 4.6.0.2, where the Job Status Service does not have protections against Cross-Site Request Forgery (CSRF). This means an attacker could trick a valid user into clicking a malicious link or visiting a malicious website, causing the user's browser to unknowingly send unauthorized requests to the Job Status Service.

Impact Analysis

The impact of this vulnerability is that an attacker can perform unauthorized actions on behalf of a valid user without their knowledge by exploiting the lack of CSRF protections. This could lead to unintended changes or operations within the Job Status Service, potentially disrupting workflows or compromising system integrity.

Hi! I’m here to help you understand CVE-2025-54969. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70