by Kastro
Paper/Archive/CVE-2023-38693

CVE-2023-38693

lucee Lucee — RCE in Lucee REST endpoint

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.4.574 × 2011.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173.

Affected

ProductAffectedFixed inSource
Lucee>= 5.4.0.0, < 5.4.3.2–CNA
Lucee>= 5.3.12.0, < 5.3.12.1–CNA
Lucee< 5.3.7.59–CNA
Lucee>= 5.3.8.0, < 5.3.8.236–CNA
Lucee>= 5.3.9.0, < 5.3.9.173–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/lucee/Lucee/security/advisories/GHSA-vwjx-mmwm-pwrf