CVE-2023-27237 : LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.

Published 2023-05-12 11:15:13

Updated 2025-01-24 20:15:29

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2023-27237

Lavalite » Lavalite » Version: 9.0.0
cpe:2.3:a:lavalite:lavalite:9.0.0:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	134c704f-9b21-4f2e-91b3-4a467353bcc0	2025-01-24
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

https://github.com/M19O/Security-Advisories/tree/main/CVE-2023-27237

Security-Advisories/CVE-2023-27237 at main · M19O/Security-Advisories · GitHub
Third Party Advisory
https://i.ibb.co/kSkqPhQ/3.png

3.png (570×347)
Broken Link
http://lavalite.com

Not Applicable
https://i.ibb.co/mJq9CH8/2.png

2.png (1678×697)
Broken Link
https://i.ibb.co/34DSW7B/1.png

1.png (1673×693)
Broken Link

Jump to