CVE-2025-47151

critical · 9.8

A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.

9.8

CVSS

1.0%

EPSS (exploit prob.)

63rd

EPSS percentile

2025-11-05

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-843

Affected products

Vendor	Product	Affected versions
entrouvert	lasso	2.5.1
entrouvert	lasso	2.8.2

Check a specific version with /api/v1/cve/match.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2025-2193
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2193

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-47151