CVE-2023-47107

CVSS V2 None CVSS V3 None
Description
PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to PILOS users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. This only affects local user accounts and requires the password reset option to be enabled. This issue has been patched in version 2.3.0.
Overview
  • CVE ID
  • CVE-2023-47107
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-11-08T15:39:50.472Z
  • Last Modified Date
  • 2023-11-08T15:39:50.472Z
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CWE-640 http://cwe.mitre.org/data/definitions/640.html
References
Reference URL Reference Tags
https://github.com/THM-Health/PILOS/security/advisories/GHSA-mc6f-fj9h-5735 x_refsource_CONFIRM
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-47107
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47107
History
Created Old Value New Value Data Type Notes
2024-06-25 09:42:36 Added to TrackCVE