CVE-2023-36984

HIGH

LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.

Affects 1 product across 1 vendor.

CVSS 3.17.5
EPSS0.7%
Percentile52th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, no availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

LavaLite CMS version 9.0.0 is vulnerable to Sensitive Data Exposure, which could allow unauthorized access to sensitive information.

BSID: BS-2023-GLOBAL-057006-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-36984?
LavaLite CMS version 9.0.0 is vulnerable to Sensitive Data Exposure, which could allow unauthorized access to sensitive information.
What is the CVSS score for CVE-2023-36984?
CVE-2023-36984 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS: 0.7%.
Is CVE-2023-36984 actively exploited?
No confirmed active exploitation of CVE-2023-36984 as of 2026-05-30.
How do I remediate CVE-2023-36984?
Priority: HIGH.
What systems are affected by CVE-2023-36984?
CVE-2023-36984 affects Lavalite Lavalite.
Vulnerability Details
CVE IDCVE-2023-36984
BSIDBS-2023-GLOBAL-057006-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published2023-08-01
Last Modified2024-11-21
ICS Relevance0%
SourceNVD
Official Description

LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper handling of sensitive data, potentially leading to exposure through various means such as improper logging, error messages, or insecure data transmission.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Lavalite Lavalite 9.0.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1172 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashc6c5793662716325a8930ac391d8de7e7da455b7f680bf3c6fdbdc161dc06192afa5effb892b31a51159f888799e72b786be9ec36b189bd969c5cd63430b304c
Related CVEs affecting Lavalite
CVE-2023-27238 9.8 LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. CVE-2025-70866 8.8 LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticat... CVE-2023-36983 7.5 LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. CVE-2022-42188 7.5 In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal atta... CVE-2019-18883 6.1 XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.
View all Lavalite CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →