CVE-2025-47292 | THREATINT

Description

Cap Collectif is an online decision making platform that integrates several tools. Before commit 812f2a7d271b76deab1175bdaf2be0b8102dd198, the `DebateAlternateArgumentsResolver` deserializes a `Cursor`, allowing any classes and which can be controlled by unauthenticated user. Exploitation of this vulnerability can lead to Remote Code Execution. The vulnerability is fixed in commit 812f2a7d271b76deab1175bdaf2be0b8102dd198.

PUBLISHED Reserved 2025-05-05 | Published 2025-05-14 | Updated 2025-05-14 | Assigner GitHub_M

CRITICAL: 9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Problem types

CWE-502: Deserialization of Untrusted Data

Product status

< 812f2a7d271b76deab1175bdaf2be0b8102dd198

affected

References

github.com/...lectif/security/advisories/GHSA-hf7r-rjh4-5fc8

github.com/...ommit/812f2a7d271b76deab1175bdaf2be0b8102dd198

cve.org (CVE-2025-47292)

nvd.nist.gov (CVE-2025-47292)

Download JSON