CVE-2025-62781 (CNNVD-202510-3454)
中文标题:
PILOS 代码问题漏洞
英文标题:
PILOS is missing session regeneration after password change
漏洞描述
中文描述:
PILOS是THM开源的一个前端软件。 PILOS 4.8.0之前版本存在代码问题漏洞，该漏洞源于密码更改后当前会话令牌未失效，可能导致攻击者继续使用已获取的会话令牌维持访问权限。
英文描述:
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session’s token remains valid and is not refreshed. If an attacker has previously obtained this session token through another vulnerability, changing the password will not invalidate their access. As a result, the attacker can continue to act as the user even after the password has been changed. This vulnerability is fixed in 4.8.0.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| THM-Health | PILOS | < 4.8.0 | - | - |
cpe:2.3:a:thm-health:pilos:<_4.8.0:*:*:*:*:*:*:*
|
| thm | pilos | * | - | - |
cpe:2.3:a:thm:pilos:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-62781 |
2025-11-11 15:23:33 | 2025-11-11 07:40:49 |
| NVD | nvd_CVE-2025-62781 |
2025-11-11 15:01:07 | 2025-11-11 07:48:35 |
| CNNVD | cnnvd_CNNVD-202510-3454 |
2025-11-11 15:13:00 | 2025-11-11 08:00:19 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 代码问题
- cnnvd_id: 未提取 -> CNNVD-202510-3454
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']