CVE-2023-47107

PILOS account takeover through password reset poisoning

State: Published
Severity: 8.8 High
Published: Nov 8, 2023
Updated: Sep 4, 2024
Reserved: Oct 30, 2023

Description

PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to PILOS users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. This only affects local user accounts and requires the password reset option to be enabled. This issue has been patched in version 2.3.0.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-20 Improper Input Validation
CWE-640 Weak Password Recovery Mechanism for Forgotten Password

Affected Products

Product	Versions
PILOSTHM-Health	>= 2.0.0, < 2.3.0Affected

References

https://github.com/THM-Health/PILOS/security/advisories/GHSA-mc6f-fj9h-5735

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.