← CVE Intelligence

CVE-2023-38693

RCE in Lucee REST endpoint PUBLISHED

Description (CNA)

Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173.

Affected (CNA)

Vendor / productVersions
lucee / Luceeaffected >= 5.4.0.0, < 5.4.3.2; affected >= 5.3.12.0, < 5.3.12.1; affected < 5.3.7.59; affected >= 5.3.8.0, < 5.3.8.236; affected >= 5.3.9.0, < 5.3.9.173

CWE

CWE-611

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.