PT-2023-30313 · Pilos · Pilos

Samuelwei · Published 2023-11-08 · Updated 2023-11-16 · CVE-2023-47107

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PILOS versions prior to 2.3.0

Description The password reset component in PILOS uses the hostname supplied within the request host header when building a password reset URL. This could allow manipulation of the URL sent to PILOS users, potentially disclosing the password reset token if the link is followed. The issue only affects local user accounts and requires the password reset option to be enabled.

Recommendations For versions prior to 2.3.0, update to version 2.3.0 to resolve the issue. As a temporary workaround, consider disabling the password reset option until the update is applied. Restrict access to the password reset component to minimize the risk of exploitation. Avoid using the password reset feature in the affected versions until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-640

CWE-20

Related Identifiers

CVE-2023-47107

GHSA-MC6F-FJ9H-5735

Affected Products

Pilos

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47107.json · Exploit
• https://github.com/THM-Health/PILOS/security/advisories/GHSA-mc6f-fj9h-5735 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47107 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47107 · Security Note
• https://t.me/latest_high_impact_cve/79 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1722315935795548276 · Twitter Post
• https://twitter.com/CVEnew/status/1722281114427908363 · Twitter Post