CVE-2023-36983

HIGH

LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.

Affects 1 product across 1 vendor.

CVSS 3.17.5
EPSS0.7%
Percentile52th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, no availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

LavaLite CMS version 9.0.0 is vulnerable to sensitive data exposure, which could allow unauthorized access to sensitive information.

BSID: BS-2023-GLOBAL-057025-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-36983?
LavaLite CMS version 9.0.0 is vulnerable to sensitive data exposure, which could allow unauthorized access to sensitive information.
What is the CVSS score for CVE-2023-36983?
CVE-2023-36983 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS: 0.7%.
Is CVE-2023-36983 actively exploited?
No confirmed active exploitation of CVE-2023-36983 as of 2026-05-30.
How do I remediate CVE-2023-36983?
Priority: HIGH.
What systems are affected by CVE-2023-36983?
CVE-2023-36983 affects Lavalite Lavalite.
Vulnerability Details
CVE IDCVE-2023-36983
BSIDBS-2023-GLOBAL-057025-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published2023-08-01
Last Modified2024-11-21
ICS Relevance0%
SourceNVD
Official Description

LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper handling of sensitive data, potentially leading to exposure through various channels such as logs, error messages, or improper data storage.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Lavalite Lavalite 9.0.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1172 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash33488b052361f9bdc3dac3460d9e7b7ada96028346cba222a884532bf6556f861b8aa675ea0bf047b8d0b71b0f990a292ab09a8b7b791acde9f5bc62e34c9f12
Related CVEs affecting Lavalite
CVE-2023-27238 9.8 LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. CVE-2025-70866 8.8 LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticat... CVE-2023-36984 7.5 LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. CVE-2022-42188 7.5 In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal atta... CVE-2019-18883 6.1 XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.
View all Lavalite CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →