« Volver al listado

CVE-2023-38693

Estado: AplazadaCrítica (9.8)—

Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XXE en endpoint REST de Lucee accesible por red sin autenticación (AV:N/PR:N/UI:N). RCE permite ejecución de código y lectura de datos del servidor.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Lucee — LuceeAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-38693",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-38693",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-06T21:58:27.654139Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "lucee",
          "product": "Lucee",
          "versions": [
            {
              "status": "affected",
              "version": ">= 5.4.0.0, < 5.4.3.2"
            },
            {
              "status": "affected",
              "version": ">= 5.3.12.0, < 5.3.12.1"
            },
            {
              "status": "affected",
              "version": "< 5.3.7.59"
            },
            {
              "status": "affected",
              "version": ">= 5.3.8.0, < 5.3.8.236"
            },
            {
              "status": "affected",
              "version": ">= 5.3.9.0, < 5.3.9.173"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-05T16:15:37.007",
  "references": [
    {
      "url": "https://github.com/lucee/Lucee/security/advisories/GHSA-vwjx-mmwm-pwrf",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173."
    },
    {
      "lang": "es",
      "value": "Lucee Server (o simplemente Lucee) es un lenguaje de etiquetas y scripts dinámicos basados en Java que se utiliza para el desarrollo rápido de aplicaciones web. El endpoint REST de Lucee es vulnerable a RCE a través de un ataque XML XXE. Esta vulnerabilidad se ha corregido en Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236 y 5.3.9.173."
    }
  ],
  "lastModified": "2026-06-17T06:10:58.063",
  "sourceIdentifier": "security-advisories@github.com"
}