CVE-2025-54969

{
  "id": "CVE-2025-54969",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-27T17:15:38.587",
  "lastModified": "2026-11-05T21:10:00.183",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not implement CSRF protections. An attacker who social engineers a valid user into clicking a malicious link or visiting a malicious website may be able to submit requests to the Job Status Service without the user's knowledge."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en BAE SOCET GXP antes de la versión 4.6.0.2. El Servicio de Estado de Trabajos de SOCET GXP no implementa protecciones CSRF. Un atacante que mediante ingeniería social engaña a un usuario válido para que haga clic en un enlace malicioso o visite un sitio web malicioso podría enviar solicitudes al Servicio de Estado de Trabajos sin el conocimiento del usuario."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-27T18:47:52.759895Z",
          "id": "CVE-2025-54969",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:baesystems:socet_gxp:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.6.0.2",
              "matchCriteriaId": "6BF9E6F9-E4EA-4880-9B20-2CEDD7D118C8"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.baesystems.com/en-us/product/geospatial-exploitation-products",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54969",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}