Host Header Injection Vulnerability in LavaLite CMS by LavaLite
CVE-2023-27237

6.1MEDIUM

Key Information:

Vendor

Lavalite

Status
Lavalite
Vendor
CVE Published:
12 May 2023

What is CVE-2023-27237?

LavaLite CMS, specifically version 9.0.0, is subject to a host header injection vulnerability, which could allow attackers to manipulate the server's response behavior. This type of vulnerability arises when a web application relies on the host header for functionalities such as redirects and responses, providing an attacker with an opportunity to reroute users or generate misleading responses. Exploiting this vulnerability can lead to significant security risks, including identity spoofing and unauthorized access to sensitive information.

References

https://i.ibb.co/34DSW7B/1.png
https://i.ibb.co/kSkqPhQ/3.png
https://i.ibb.co/mJq9CH8/2.png

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.