CVE-2025-47292
Published: 14 May 2025
Summary
CVE-2025-47292 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.5 (Critical).
Operationally, ranked in the top 10.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Cap Collectif is an online decision-making platform that integrates multiple tools. Prior to commit 812f2a7d271b76deab1175bdaf2be0b8102dd198, the DebateAlternateArgumentsResolver component performed unsafe deserialization of a Cursor object. This flaw, tracked as CWE-502, permitted an unauthenticated remote attacker to supply arbitrary classes for deserialization and resulted in a CVSS 4.0 score of 9.5.
An unauthenticated attacker with network access can supply a malicious serialized Cursor to the resolver, achieving remote code execution on the server. No user interaction or authentication is required, and the attack can also impact confidentiality, integrity, and availability in both the vulnerable component and dependent systems.
The vulnerability is addressed in commit 812f2a7d271b76deab1175bdaf2be0b8102dd198; the corresponding GitHub Security Advisory GHSA-hf7r-rjh4-5fc8 recommends upgrading to the patched version. The associated EPSS score remains flat at 0.0488 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28081
Vulnerability details
Cap Collectif is an online decision making platform that integrates several tools. Before commit 812f2a7d271b76deab1175bdaf2be0b8102dd198, the `DebateAlternateArgumentsResolver` deserializes a `Cursor`, allowing any classes and which can be controlled by unauthenticated user. Exploitation of this vulnerability can lead to Remote Code…
more
Execution. The vulnerability is fixed in commit 812f2a7d271b76deab1175bdaf2be0b8102dd198.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.