CyberRota Analysis
AI-GeneratedThe CacheController.refreshCache endpoint in novel-plus versions up to 5.3.3 is vulnerable due to an insecure default cache-management password, allowing anonymous attackers to invalidate portal caches. This can lead to unnecessary database load and performance degradation as attackers exploit the hardcoded default password to trigger cache refreshes. Organizations using this software should prioritize remediation to prevent potential denial-of-service scenarios and maintain system integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.