BAE SOCET GXP XML External Entity Vulnerability Allowing Outbound Requests and Information Disclosure

A vulnerability in BAE SOCET GXP versions prior to 4.6.0.3 allows XML External Entities (XXE) to be processed in certain XML-based files. This issue can be exploited if an attacker social engineers a SOCET GXP user into opening a malicious file, such as a saved workspace. The vulnerability could trigger various outbound requests, potentially compromising sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized outbound requests being made from the SOCET GXP application, potentially allowing for the interception or leakage of sensitive information.

Remediation

Users are advised to update to SOCET GXP version 4.6.0.3. If an immediate update is not possible, users should only open files from trusted sources.