Security readout for executives and security teams
Plain-English summary
CVE-2019-25355 is a path traversal flaw in Genivia gSOAP 2.8. An unauthenticated remote attacker may read sensitive files from affected systems through crafted HTTP requests. This is a confidentiality-focused issue: the cited scoring shows high data exposure impact, not integrity or availability impact.
Executive priority
Treat as a high-priority exposure review for any internet-facing service using gSOAP 2.8. Prioritize inventory and vendor remediation checks because the issue is remotely reachable, unauthenticated, and has public exploit material.
Technical view
The issue is classified as CWE-22 in gSOAP 2.8. The source bundle describes unauthenticated network access, low attack complexity, and crafted HTTP path traversal enabling system file retrieval. CVSS 4.0 score is 8.7. Public exploit reference exists, but the bundle does not show CISA KEV listing or confirmed active exploitation.
Likely exposure
Exposure is most likely where applications or embedded products use Genivia gSOAP 2.8 and expose its HTTP service or generated SOAP/XML web service components to untrusted networks.
Exploitation context
A public Exploit-DB entry is referenced, increasing practical risk. However, KEV is false and the provided sources do not state active exploitation in the wild. Risk is highest for internet-facing or partner-facing gSOAP 2.8 services.
Researcher notes
Sources identify Genivia gSOAP 2.8 as affected and describe unauthenticated path traversal file read. No patch version, workaround, or active exploitation evidence is provided in the bundle. The CVE publication date appears recent despite the CVE year and Exploit-DB reference.
Mitigation direction
- Inventory applications and appliances using Genivia gSOAP 2.8.
- Check Genivia guidance and product maintainers for fixed versions or supported upgrades.
- Restrict external access to affected gSOAP services where business permits.
- Place vulnerable services behind authentication, filtering, or network controls where possible.
- Monitor web requests for path traversal indicators targeting gSOAP endpoints.
Validation and detection
- Confirm whether gSOAP 2.8 is present in application dependencies or vendor components.
- Identify externally reachable services built with or embedding gSOAP.
- Review application logs for suspicious traversal-style HTTP paths.
- Check vendor advisories and maintainers for version-specific remediation.
- Verify compensating controls block unauthenticated file-read attempts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-25355 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-47653CVE reference · exploit
- Vendor HomepageCVE reference · product
- Product Details PageCVE reference · product
- VulnCheck Advisory: Genivia gSOAP 2.8 - 'gSOAP' Path TraversalCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.