PT-2025-44036 · Laravel+2 · Laravel+2

Published 2025-10-27 · Updated 2025-11-04 · CVE-2025-62523

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PILOS versions prior to 4.8.0

Description PILOS, a frontend for BigBlueButton, has a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware. The system reflects the Origin request header in the Access-Control-Allow-Origin response header without validation or a whitelist, while Access-Control-Allow-Credentials is set to true. This could allow a malicious website from a different origin to send requests, potentially including credentials, to the PILOS API. Exploitation may enable the exfiltration of data or actions using the victim’s credentials if the server accepts these cross-origin requests as authenticated. Laravel’s session handling includes origin checks that prevent authentication of cross-origin requests by default, and this misconfiguration is not believed to be exploitable in typical deployments due to these session-origin protections.

Recommendations Update to PILOS version 4.8.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-942

Related Identifiers

CVE-2025-62523

GHSA-PGFW-F4MP-5445

Affected Products

Bigbluebutton

Laravel

Pilos

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62523.json · Exploit
• https://github.com/THM-Health/PILOS/security/advisories/GHSA-pgfw-f4mp-5445 · Vendor Advisory
• https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62523 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62523 · Vendor Advisory
• https://t.me/cveNotify/141680 · Telegram Post
• https://t.me/CVEtracker/35881 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1983049200544694761 · Twitter Post