CVE-2023-38693

CRITICAL

Lucee < 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, 5.3.9.173 - Remote Code Execution via XML External Entity Injection

Title source: llm
STIX 2.1

Description

Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173.

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.0076
EPSS Percentile 50.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-611
Status published
Products (6)
lucee/Lucee < 5.3.7.59
lucee/Lucee >= 5.3.12.0, < 5.3.12.1
lucee/Lucee >= 5.3.8.0, < 5.3.8.236
lucee/Lucee >= 5.3.9.0, < 5.3.9.173
lucee/Lucee >= 5.4.0.0, < 5.4.3.2
org.lucee/lucee 5.3.10.79-RC - 5.3.12.1Maven
Published Mar 05, 2025
Tracked Since Feb 18, 2026