VulnerabilityAnalyzed

CVE-2025-54969

The SOCET GXP Job Status Service does not implement CSRF protections.

MEDIUM 6.1EPSS 0.13%

Does this matter?

Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not implement CSRF protections. An attacker who social engineers a valid user into clicking a malicious link or visiting a malicious website may be able to submit requests to the Job Status Service without the user's knowledge.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L
EPSS: 0.13% probability · 3th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: baesystems/socet gxp
Source: cve@mitre.org

References

https://www.baesystems.com/en-us/product/geospatial-exploitation-productsProduct
https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54969Mitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.