CVE-2023-27237

MediumCVSS 6.1

Published: 12/05/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

44th percentile - higher than 44% of all known CVEs

Summary

LavaLite CMS version 9.0.0 was found to be vulnerable to a host header injection attack. An attacker can manipulate the Host header in HTTP requests, potentially leading to unauthorized actions.

Risk Assessment

The risk includes possible cache poisoning, session hijacking, or redirecting users to malicious sites, which could compromise data integrity and confidentiality.

Recommendation

It is recommended to immediately update LavaLite CMS to the latest available version that fixes this vulnerability. Also configure the web server to validate the Host header.

Original NVD description (English source)

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.