CVE-2023-38693 - CVE House
Back to Database
Status published Critical CVE-2023-38693

RCE in Lucee REST endpoint

Vulnerability Description

Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-38693

Credits & Attribution

No credits recorded in the NVD database.

References

More from lucee

View All →
CVE-2021-21307
Remote Code Exploit in Lucee Admin
High 8.6

Affected Vendor

Affected Software

Lucee
Vulnerable Versions:
>= 5.4.0.0, < 5.4.3.2, >= 5.3.12.0, < 5.3.12.1, < 5.3.7.59, >= 5.3.8.0, < 5.3.8.236, >= 5.3.9.0, < 5.3.9.173

Timeline

Official Publish: March 5th, 2025
Last Modified: March 6th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-611

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1040 Network Sniffing
Collection
T1105 Ingress Tool Transfer
Command and Control
T1499 Endpoint Denial of Service
Impact