CVE-2021-21307

Katalog CVE

CVSS 9.8 · Critical EPSS 89,2%

Kerentanan Missing Authorization pada lucee server. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.

Rincian

Terbit di NVD

11 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

89,2% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dev.lucee.org/t/lucee-vulnerability-alert-november-2020/7643 advisory vendor
• http://ciacfug.org/blog/updating-lucee-as-part-of-a-vulnerability-alert-response patch · advisory pihak ketiga
• https://github.com/lucee/Lucee/commit/6208ab7c44c61d26c79e0b0af10382899f57e1ca patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/163864/Lucee-Administrator-imgProcess.cfm-Arbitrary-File-Write.html exploit · advisory pihak ketiga · vdb entry
• https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md exploit · advisory pihak ketiga
• https://portswigger.net/daily-swig/security-researchers-earn-50k-after-exposing-critical-flaw-in-apple-travel-... press/media coverage · advisory pihak ketiga
• https://github.com/lucee/Lucee/security/advisories/GHSA-2xvv-723c-8p7r product