CVE-2025-62523

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62523", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-15T15:03:28.135Z", "datePublished": "2025-10-27T20:10:51.351Z", "dateUpdated": "2025-10-27T20:38:52.301Z"}, "containers": {"cna": {"title": "PILOS Misconfigured the Access-Control-Allow-Origin Header", "problemTypes": [{"descriptions": [{"cweId": "CWE-942", "lang": "en", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-pgfw-f4mp-5445", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-pgfw-f4mp-5445"}, {"name": "https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8", "tags": ["x_refsource_MISC"], "url": "https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8"}], "affected": [{"vendor": "THM-Health", "product": "PILOS", "versions": [{"version": "< 4.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-27T20:10:51.351Z"}, "descriptions": [{"lang": "en", "value": "PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper validation or a whitelist, while Access-Control-Allow-Credentials is set to true. This behavior could allow a malicious website on a different origin to send requests (including credentials) to the PILOS API. This may enable exfiltration or actions using the victim\u2019s credentials if the server accepts those cross-origin requests as authenticated. Laravel\u2019s session handling applies additional origin checks such that cross-origin requests are not authenticated by default. Because of these session-origin protections, and in the absence of any other unknown vulnerabilities that would bypass Laravel\u2019s origin/session checks, this reflected-Origin CORS misconfiguration is not believed to be exploitable in typical PILOS deployments. This vulnerability has been patched in PILOS in v4.8.0"}], "source": {"advisory": "GHSA-pgfw-f4mp-5445", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-27T20:38:45.364226Z", "id": "CVE-2025-62523", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T20:38:52.301Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62523", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T20:38:45.364226Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T20:38:49.494Z"}}], "cna": {"title": "PILOS Misconfigured the Access-Control-Allow-Origin Header", "source": {"advisory": "GHSA-pgfw-f4mp-5445", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "THM-Health", "product": "PILOS", "versions": [{"status": "affected", "version": "< 4.8.0"}]}], "references": [{"url": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-pgfw-f4mp-5445", "name": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-pgfw-f4mp-5445", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8", "name": "https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper validation or a whitelist, while Access-Control-Allow-Credentials is set to true. This behavior could allow a malicious website on a different origin to send requests (including credentials) to the PILOS API. This may enable exfiltration or actions using the victim\u2019s credentials if the server accepts those cross-origin requests as authenticated. Laravel\u2019s session handling applies additional origin checks such that cross-origin requests are not authenticated by default. Because of these session-origin protections, and in the absence of any other unknown vulnerabilities that would bypass Laravel\u2019s origin/session checks, this reflected-Origin CORS misconfiguration is not believed to be exploitable in typical PILOS deployments. This vulnerability has been patched in PILOS in v4.8.0"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-942", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-27T20:10:51.351Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62523", "state": "PUBLISHED", "dateUpdated": "2025-10-27T20:38:52.301Z", "dateReserved": "2025-10-15T15:03:28.135Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-27T20:10:51.351Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "PILOS", "vendor": "THM-Health", "versions": [{"status": "affected", "version": "< 4.8.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:thm:pilos:*:*:*:*:*:*:*:*", "matchCriteriaId": "91445D94-4D77-4EFF-A078-6AEF72F6E116", "versionEndExcluding": "4.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper validation or a whitelist, while Access-Control-Allow-Credentials is set to true. This behavior could allow a malicious website on a different origin to send requests (including credentials) to the PILOS API. This may enable exfiltration or actions using the victim\u2019s credentials if the server accepts those cross-origin requests as authenticated. Laravel\u2019s session handling applies additional origin checks such that cross-origin requests are not authenticated by default. Because of these session-origin protections, and in the absence of any other unknown vulnerabilities that would bypass Laravel\u2019s origin/session checks, this reflected-Origin CORS misconfiguration is not believed to be exploitable in typical PILOS deployments. This vulnerability has been patched in PILOS in v4.8.0"}, {"lang": "es", "value": "PILOS (Plataforma para Seminarios Interactivos en Vivo en L\u00ednea) es un frontend para BigBlueButton. PILOS antes de la versi\u00f3n 4.8.0 incluye una mala configuraci\u00f3n de Intercambio de Recursos de Origen Cruzado (CORS) en su middleware: refleja el encabezado de solicitud Origin de vuelta en el encabezado de respuesta Access-Control-Allow-Origin sin una validaci\u00f3n adecuada o una lista blanca, mientras que Access-Control-Allow-Credentials est\u00e1 configurado como verdadero. Este comportamiento podr\u00eda permitir que un sitio web malicioso en un origen diferente env\u00ede solicitudes (incluyendo credenciales) a la API de PILOS. Esto podr\u00eda permitir la exfiltraci\u00f3n o acciones utilizando las credenciales de la v\u00edctima si el servidor acepta esas solicitudes de origen cruzado como autenticadas. El manejo de sesiones de Laravel aplica comprobaciones de origen adicionales de modo que las solicitudes de origen cruzado no se autentican por defecto. Debido a estas protecciones de origen de sesi\u00f3n, y en ausencia de cualquier otra vulnerabilidad desconocida que eludir\u00eda las comprobaciones de origen/sesi\u00f3n de Laravel, esta mala configuraci\u00f3n de CORS con Origin reflejado no se considera explotable en implementaciones t\u00edpicas de PILOS. Esta vulnerabilidad ha sido parcheada en PILOS en la v4.8.0"}], "id": "CVE-2025-62523", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62523", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-27T20:38:45.364226Z", "version": "2.0.3"}}]}, "published": "2025-10-27T21:15:37.770", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-pgfw-f4mp-5445"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-942"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-28T10:24:26.496682+00:00", "updated": "2025-10-28T10:24:26.496707+00:00", "vendors": ["thm", "thm$PRODUCT$pilos"]}