CVE-2023-27238

CRITICAL

LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS0.9%
Percentile58th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-444: CWE-444
Related Attack Patterns (CAPEC)
CAPEC-33 HTTP Request Smuggling
via CWE-444
CAPEC-273 HTTP Response Smuggling
via CWE-444

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

LavaLite CMS v 9.0.0 is vulnerable to web cache poisoning, which could allow attackers to manipulate cached content and potentially execute arbitrary code or access sensitive information.

BSID: BS-2023-GLOBAL-348780-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-27238?
LavaLite CMS v 9.0.0 is vulnerable to web cache poisoning, which could allow attackers to manipulate cached content and potentially execute arbitrary code or access sensitive information.
What is the CVSS score for CVE-2023-27238?
CVE-2023-27238 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.9%.
Is CVE-2023-27238 actively exploited?
No confirmed active exploitation of CVE-2023-27238 as of 2026-09-25.
How do I remediate CVE-2023-27238?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-27238?
CVE-2023-27238 affects Lavalite Lavalite.
Vulnerability Details
CVE IDCVE-2023-27238
BSIDBS-2023-GLOBAL-348780-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2023-05-12
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-444
SourceNVD
Official Description

LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper handling of user input in the caching mechanism, enabling attackers to inject malicious content into the cache, which is then served to other users.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Lavalite Lavalite 9.0.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1252 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashe019f0905c4dd175e81c3a5e214356e045d9e54347b8f83ae9c737195c5f10aae34d7d45f20989c24d1d9a37fc5598555239857e1fdae54d7ed4770f64760cbe
Related CVEs affecting Lavalite
CVE-2025-70866 8.8 LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticat... CVE-2023-36983 7.5 LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. CVE-2023-36984 7.5 LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. CVE-2022-42188 7.5 In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal atta... CVE-2019-18883 6.1 XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.
View all Lavalite CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →