A directory traversal vulnerability in BAE SOCET GXP allows authenticated attackers to access sensitive files on the host system, posing a risk of unauthorized information disclosure.

This is a directory traversal vulnerability occurring within the GXP Job Service. An authenticated attacker can submit a crafted job request containing unsanitized paths to read arbitrary files with the privileges of the GXP Job Service process.

The ability to read arbitrary files from the server filesystem can lead to the exposure of sensitive configuration files, credentials, or proprietary geospatial data. Given the CVSS score of 7.5, this vulnerability represents a high risk to data confidentiality and organizational security, particularly for environments handling sensitive intelligence or mapping assets.

Immediate Action: Update BAE SOCET GXP to version 4.6.0.2 or later to apply the necessary path sanitization fixes.

Proactive Monitoring: Review access logs for the GXP Job Service to identify abnormal job requests or attempts to access unexpected file paths.

Compensating Controls: Restrict network access to the GXP Job Service to trusted users only, as the vulnerability requires authenticated access to the service to trigger the flaw.

Public Exploit Available: Unknown

BAE SOCET GXP users should prioritize upgrading to version 4.6.0.2 immediately. Because the vulnerability allows for unauthorized file access, failing to patch exposes the system to potential information theft by any user with access to the GXP Job Service. Verify that all internal systems are updated and audit user permissions to ensure the principle of least privilege is strictly enforced for the Job Service interface.