What is the CVSS score of CVE-2025-1927?

CVE-2025-1927 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-1927?

Within 24 hours: Inventory all instances of Restajet across your organization and document current version numbers; notify the vendor directly through alternative channels if initial contact failed. Within 7 days: Implement network-level controls and review access logs for suspicious state-changing operations by authenticated users; consider restricting Restajet to internal networks only if operationally feasible. Within 30 days: Establish a vendor communication protocol to confirm patch availability; evaluate migration to alternative food delivery platforms if no patch timeline is provided.

CVE-2025-1927

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-19 iletisim@usom.gov.tr

CSRF

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 08:22 vuln.today

CVE Published

Dec 19, 2025 - 12:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Cross Site Request Forgery.This issue affects Online Food Delivery System: through 19122025. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authenticated attackers can perform unauthorized state-changing operations in Restajet Online Food Delivery System (all versions through December 19, 2025) by exploiting missing CSRF protections. The vulnerability, disclosed by Turkey's USOM (National Cyber Incident Response Center), carries a CVSS score of 7.1 with high integrity impact, though EPSS modeling indicates only 0.02% exploitation probability (5th percentile). No public exploit identified at time of analysis, and vendor did not respond to disclosure attempts.

Technical ContextAI

This vulnerability stems from CWE-352 (Cross-Site Request Forgery), a weakness in web application session management where the application fails to validate that state-changing requests originated from the legitimate user. The affected product (CPE: cpe:2.3:a:restajet:online_food_delivery_system) is a commercial food ordering platform developed by Restajet Information Technologies Inc. In CSRF attacks, malicious websites or emails trick authenticated users' browsers into submitting forged HTTP requests without proper anti-CSRF tokens or same-site cookie protections. The CVSS vector indicates network-based exploitation (AV:N) with low complexity (AC:L) requiring an authenticated session (PR:L) but no user interaction beyond maintaining the session (UI:N), producing high integrity impact (I:H) with limited confidentiality exposure (C:L) and no availability impact (A:N).

RemediationAI

No vendor-released patch identified at time of analysis, as Restajet Information Technologies Inc. did not respond to vulnerability disclosure. Until vendor remediation becomes available, implement compensating controls: deploy web application firewall rules to enforce anti-CSRF token validation on all state-changing requests (POST, PUT, DELETE operations), configure SameSite=Strict or SameSite=Lax cookie attributes on session cookies to prevent cross-origin request inclusion, implement custom middleware to verify Referer and Origin headers match the application domain, and consider restricting application access to trusted IP ranges via network segmentation. For critical deployments, evaluate migration to alternative food delivery platforms with active security maintenance. Monitor USOM advisory at https://www.usom.gov.tr/bildirim/tr-25-0469 and VulDB at https://vuldb.com/?id.337613 for potential vendor updates.