Log in Start free

Vulnerability · Published Feb 11, 2021 · Assigned by GitHub_M

CVE-2021-21307Remote Code Exploit in Lucee Admin

High 8.6

In plain English

A high-severity missing authorization in Lucee from lucee. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 89.2% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)89.2%top 0.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Metasploit, Nuclei

Official description

Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.

Affected products (as reported)

VendorProductVersions
lucee Lucee >= 5.3.5.0, < 5.3.5.96>= 5.3.6.0, < 5.3.6.68>= 5.3.7.0, < 5.3.7.47

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References