Description: Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.
CVE-2021-21307
Published Date: 2021-02-11T19:15Z
Last Modified: 2021-09-21T16:39Z
CVSS Score: 9.8 (CRITICAL)
EPSS Score: 97.32%
Risk Score: 7.15 (CRITICAL)
Risk Score based on CVSS score and EPSS. This score is for reference purposes and is not internationally recognized.
CVSS:
9.8 |
EPSS:
97.32%
Mitre ATT&CK Technical v15.1
T1583.004 – Server
T1064 – Scripting
T1584.004 – Server
T1053.002 – At
Technical Analysis & Mitigation Measures
Reference Links
https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md
http://ciacfug.org/blog/updating-lucee-as-part-of-a-vulnerability-alert-response
https://portswigger.net/daily-swig/security-researchers-earn-50k-after-exposing-critical-flaw-in-apple-travel-portal
https://dev.lucee.org/t/lucee-vulnerability-alert-november-2020/7643
https://github.com/lucee/Lucee/commit/6208ab7c44c61d26c79e0b0af10382899f57e1ca
https://github.com/lucee/Lucee/security/advisories/GHSA-2xvv-723c-8p7r
http://packetstormsecurity.com/files/163864/Lucee-Administrator-imgProcess.cfm-Arbitrary-File-Write.html
Vendor - Produce - Version
lucee_server - lucee, lucee_server - lucee, lucee_server - lucee
Disclaimer
The content on this website is automatically sourced from external websites such as the National Vulnerability Database (NVD), GitHub, and other security-related sources. This content is for reference purposes only, and we are not responsible for the accuracy or integrity of the information linked or displayed from these sources.