CVE-2023-47107

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to PILOS users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. This only affects local user accounts and requires the password reset option to be enabled. This issue has been patched in version 2.3.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-640

Affected software

No affected versions have been published.

Timeline

Published: Nov 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-471087.5OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.CVE-2023-471098.1PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustwor CVE-2023-47118.1A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819. Affected by this issue is some unkno CVE-2023-471105.3blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An a CVE-2023-471113.7ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a `Lockout Policy` with a maximum amount CVE-2023-471124.3Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs us CVE-2023-471137.3BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijackin CVE-2023-471146.1Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and CVE-2023-471155.4Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting (XSS) vulnerability that co CVE-2023-471165.3Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tes CVE-2023-471177.5Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users CVE-2023-471189.8ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap