GHSA-vwjx-mmwm-pwrf

Source

https://github.com/advisories/GHSA-vwjx-mmwm-pwrf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-vwjx-mmwm-pwrf/GHSA-vwjx-mmwm-pwrf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vwjx-mmwm-pwrf

Aliases

CVE-2023-38693

Published

2025-03-05T18:31:03Z

Modified

2025-03-05T19:44:47Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Lucee RCE/XXE Vulnerability

Details

Impact

The Lucee team received a responsible disclosure of a security vulnerability which affects all previous releases of Lucee.

After reviewing the report and confirming the vulnerability, the Lucee team then conducted a further security review and found additional vulnerabilities which have been addressed as part of this this security update.

Patches

Lucee 5.4.3.2 and 5.3.12.1 stable releases have been patched with additional hardening

The older releases, 5.3.7.59., 5.3.8.236 and 5.3.9.173 have also been patched

Any users running older release, should plan to immediately upgrade to the latest stable release

6.0 will have a RC as it's not yet released

Database specific

{
    "cwe_ids":  [
        "CWE-611"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-03-05T18:31:03Z",
    "nvd_published_at":  "2025-03-05T16:15:37Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Maven / org.lucee:lucee

Package

Name: org.lucee:lucee; View open source insights on deps.dev
Purl: pkg:maven/org.lucee/lucee

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.3.10.79-RC

Fixed

5.3.12.1

Affected versions

5.*

5.3.10.79-RC

5.3.10.94-RC

5.3.10.97

5.3.10.120

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-vwjx-mmwm-pwrf/GHSA-vwjx-mmwm-pwrf.json"

Maven / org.lucee:lucee

Package

Name: org.lucee:lucee; View open source insights on deps.dev
Purl: pkg:maven/org.lucee/lucee

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.4.0.65-RC

Fixed

5.4.3.2

Affected versions

5.*

5.4.0.65-RC

5.4.0.77-RC

5.4.0.80

5.4.1.8

5.4.2.17

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-vwjx-mmwm-pwrf/GHSA-vwjx-mmwm-pwrf.json"

Maven / org.lucee:lucee

Package

Name: org.lucee:lucee; View open source insights on deps.dev
Purl: pkg:maven/org.lucee/lucee

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

5.3.7.59

Affected versions

5.*

5.0.0.22

5.0.0.60-BETA

5.0.0.62-BETA

5.0.0.65-BETA

5.0.0.98-BETA

5.0.0.120-BETA

5.0.0.172-BETA

5.0.0.174-BETA

5.0.0.178-BETA

5.0.0.213-BETA

5.0.0.219-RC

5.0.0.235-RC

5.0.0.252

5.0.0.254

5.0.1.85

5.1.0.17-BETA

5.1.0.31-BETA

5.1.0.31

5.1.0.34

5.1.1.65

5.1.2.24

5.1.3.18

5.1.4.18

5.1.4.19

5.2.0.11-ALPHA

5.2.1.7

5.2.1.8

5.2.1.9

5.2.2.68-RC

5.2.2.70-RC

5.2.2.71-RC

5.2.2.71

5.2.3.30-RC

5.2.3.31-RC

5.2.3.32-RC

5.2.3.33-RC

5.2.3.34-RC

5.2.3.35-RC

5.2.3.35

5.2.4.35-RC

5.2.4.36-RC

5.2.4.37-RC

5.2.4.37

5.2.5.20-RC

5.2.5.20

5.2.6.59-RC

5.2.6.59

5.2.6.60

5.2.7.61-RC

5.2.7.62

5.2.7.63

5.2.8.50-RC

5.2.8.50

5.2.9.28-RC

5.2.9.29-RC

5.2.9.31

5.3.0.34-ALPHA

5.3.0.86-BETA

5.3.1.15-BETA

5.3.1.87-RC

5.3.1.91

5.3.1.94-RC

5.3.1.95

5.3.1.102

5.3.1.103

5.3.2.74-RC

5.3.2.77

5.3.3.60-RC

5.3.3.62

5.3.3.67

5.3.4.54-RC

5.3.4.73-RC

5.3.4.77

5.3.4.80

5.3.5.78-RC

5.3.5.92

5.3.6.53-RC

5.3.6.61

5.3.6.68

5.3.7.34-RC

5.3.7.47

5.3.7.59

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-vwjx-mmwm-pwrf/GHSA-vwjx-mmwm-pwrf.json"

Maven / org.lucee:lucee

Package

Name: org.lucee:lucee; View open source insights on deps.dev
Purl: pkg:maven/org.lucee/lucee

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.3.8.132-RC

Fixed

5.3.8.236

Affected versions

5.*

5.3.8.132-RC

5.3.8.139-RC

5.3.8.167-RC

5.3.8.189

5.3.8.201

5.3.8.205

5.3.8.206

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-vwjx-mmwm-pwrf/GHSA-vwjx-mmwm-pwrf.json"

Maven / org.lucee:lucee

Package

Name: org.lucee:lucee; View open source insights on deps.dev
Purl: pkg:maven/org.lucee/lucee

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.3.9.113

Fixed

5.3.9.173

Affected versions

5.*

5.3.9.133

5.3.9.141-RC

5.3.9.141

5.3.9.160

5.3.9.166

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-vwjx-mmwm-pwrf/GHSA-vwjx-mmwm-pwrf.json"