CVE-2025-13953
BaseFortify
Publication date: 2025-12-10
Last updated on: 2025-12-10
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gtt | sistema_de_informacion_tributario | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-290 | This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability compromises the confidentiality, integrity, and availability of the application and its data by allowing an attacker to authenticate as any user without valid credentials. Such a breach could lead to unauthorized access to sensitive personal or financial data managed by the GTT Tax Information System, potentially resulting in non-compliance with data protection regulations like GDPR and HIPAA that require strict controls over access and protection of sensitive information. [1]
Can you explain this vulnerability to me?
This vulnerability is an authentication bypass in the GTT Tax Information System application related to its Active Directory (LDAP) login method. The application uses a local WebSocket for authentication but does not properly verify the authenticity or origin of data received through it. An attacker with access to the local machine or internal network can impersonate the legitimate WebSocket and inject manipulated data, allowing them to authenticate as any user in the domain without valid credentials. [1]
How can this vulnerability impact me? :
Exploiting this vulnerability allows an attacker to authenticate as any domain user without needing valid credentials. This compromises the confidentiality, integrity, and availability of the GTT Tax Information System application and its data, potentially leading to unauthorized access, data manipulation, and service disruption. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to disable the Active Directory (LDAP) authentication method in the GTT Sistema de Información Tributario application. This action renders the vulnerability no longer exploitable. [1]