CVE-2023-27238 describes a critical web cache poisoning vulnerability in LavaLite CMS version 9.0.0. This flaw carries a CVSS score of 9.8, indicating a severe risk due to its network-based attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability impacts. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or community discussion has been observed, the high FAUCET Risk Score of 78/100 suggests a significant underlying threat. Organizations using the affected LavaLite CMS version should prioritize patching to mitigate this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
9.0.0CPE matchmatch criteria | cpe:2.3:a:lavalite:lavalite:9.0.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.