title: Remote Code Exploit in Lucee Admin
description: Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.
problem types: CWE-862: Missing Authorization
affected:
{
product: Lucee
vendor: lucee
versions:
status: affected, version: >= 5.3.5.0, < 5.3.5.96
status: affected, version: >= 5.3.6.0, < 5.3.6.68
status: affected, version: >= 5.3.7.0, < 5.3.7.47
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
version: 3.1
]