CyberRota Analysis
AI-GeneratedPILOS versions 2.1.0 to 4.14.1 are vulnerable due to the absence of a Cross-Origin-Opener-Policy response header, allowing malicious pages to exploit the window.opener reference and potentially redirect authenticated users to phishing sites. This vulnerability poses a medium risk, particularly for organizations using PILOS for online seminars, as it could lead to unauthorized access and credential theft. Users of affected versions should prioritize upgrading to version 4.14.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.