PT-2025-44037 · Pilos+2 · Pilos+2

Published 2025-10-27 · Updated 2025-11-04 · CVE-2025-62524

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PILOS versions prior to 4.8.0

Description PILOS, a frontend for BigBlueButton, reveals the PHP version through the X-Powered-By header. This information disclosure allows attackers to fingerprint the server and identify potential exploits. The PHP version can also be determined by examining the PILOS version displayed in the footer and reviewing the source code on GitHub. This issue stems from the base PHP image used.

Recommendations Update to PILOS version 4.8.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-497

CWE-200

Related Identifiers

CVE-2025-62524

GHSA-Q93H-5J6H-J22X

Affected Products

Bigbluebutton

Php

Pilos

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62524.json · Exploit
• https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8 · Patch
• https://github.com/THM-Health/PILOS/security/advisories/GHSA-q93h-5j6h-j22x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62524 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62524 · Vendor Advisory
• https://t.me/cveNotify/141681 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1983046641025208698 · Twitter Post
• https://t.me/CVEtracker/35896 · Telegram Post