by Kastro
Paper/Archive/CVE-2021-21307

CVE-2021-21307

lucee Lucee — Remote Code Exploit in Lucee Admin

EPSS 89%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.8.998 × 2020.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.

Affected

ProductAffectedFixed inSource
Lucee>= 5.3.5.0, < 5.3.5.96–CNA
Lucee>= 5.3.6.0, < 5.3.6.68–CNA
Lucee>= 5.3.7.0, < 5.3.7.47–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References

refgithub.com/lucee/Lucee/security/advisories/GHSA-2xvv-723c-8p7rrefgithub.com/lucee/Lucee/commit/6208ab7c44c61d26c79e0b0af10382899f57e1carefdev.lucee.org/t/lucee-vulnerability-alert-november-2020/7643refgithub.com/httpvoid/writeups/blob/main/Apple-RCE.mdrefportswigger.net/daily-swig/security-researchers-earn-50k-after-exposing-critical-flaw-in-apple-travel-portalrefciacfug.org/blog/updating-lucee-as-part-of-a-vulnerability-alert-responserefpacketstormsecurity.com/files/163864/Lucee-Administrator-imgProcess.cfm-Arbitrary-File-Write.html