CVE-2025-62524: thm pilos

csirt@kutim:~/threat-intel/cve/CVE-2025-62524

CVSS 5.3 · Medium EPSS 0,26%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada thm pilos. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.

Rincian

Terbit di NVD: 27 Oktober 2025
Terakhir diubah: 8 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
EPSS (30 hari): 0,26% peluang dieksploitasi; lebih tinggi dari 16,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
thm	pilos	Semua versi sebelum 4.8.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/THM-Health/PILOS/security/advisories/GHSA-q93h-5j6h-j22x mitigasi · advisory vendor
https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 00:26 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.