vulnerability
Lucee Administrator: Unauthenticated Remote Code Execution (CVE-2021-21307)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:L/Au:N/C:P/I:P/A:P) | Feb 11, 2021 | Jun 14, 2021 | Sep 10, 2021 |
Severity
7
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Feb 11, 2021
Added
Jun 14, 2021
Modified
Sep 10, 2021
Description
Lucee Server is a dynamic, Java based (JSR-223), tag and scripting
language used for rapid web application development. In Lucee Admin before
versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote
code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As
a workaround, one can block access to the Lucee Administrator.
Solution
http-lucee-admin-cve-2021-21307
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.