TI-2023-25447 Aliases CVE-2023-47107

PILOS account takeover through password reset poisoning

MEDIUM 41CWE-20Published 2023-11-08 · Updated 2024-09-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-640.

Summary

PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to PILOS users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. This only affects local user accounts and requires the password reset option to be enabled. This issue has been patched in version 2.3.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00599 48th percentileScored 2026-11-07

Fix Fixed PILOS (THM-Health): 2.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
THM-Health	PILOS	2.0.0 to before 2.3.0	2.3.0	Patch available	CNA

PILOS VendorTHM-Health Affected 2.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:thm:pilos::::::::	2.0.0 to before 2.3.0	Vulnerable	THM-Health

cpe:2.3:a:thm:pilos:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.3.0 Vulnerable ·THM-Health

Remediation

Fix · CNA PILOS (THM-Health) Fixed in 2.3.0

Timeline

2026-10-02 Threatist record created from CVE-2023-47107

References

Advisory 1

https://github.com/THM-Health/PILOS/security/advisories/GHSA-mc6f-fj9h-5735

TI-2025-38763 PILOS Misconfigured the Access-Control-Allow-Origin Header CVSS 3.1MEDIUM 6.3
TI-2025-38764 PILOS Exposes PHP version CVSS 3.1MEDIUM 5.3
TI-2025-38964 PILOS is missing session regeneration after password change CVSS 3.1MEDIUM 5.0
TI-2026-18318 PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences CVSS 3.1MEDIUM 4.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences