CVE-2023-38693

CRITICAL

Lucee <5.4.3.2-5.3.9.173 - RCE

Title source: llm
STIX 2.1

Description

Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173.

Scores

CVSS v3 9.8
EPSS 0.0022
EPSS Percentile 44.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-611
Status published
Products (6)
lucee/Lucee < 5.3.7.59
lucee/Lucee >= 5.3.12.0, < 5.3.12.1
lucee/Lucee >= 5.3.8.0, < 5.3.8.236
lucee/Lucee >= 5.3.9.0, < 5.3.9.173
lucee/Lucee >= 5.4.0.0, < 5.4.3.2
org.lucee/lucee 5.3.10.79-RC - 5.3.12.1Maven
Published Mar 05, 2025
Tracked Since Feb 18, 2026