CVE-2023-38693 — RCE in Lucee REST endpoint
Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via …
Published: 2025-03-05 · CVSS: 9.8 · CVSS 3.1
Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7