CVE-2021-21307 in the critical feed json
Remote Code Exploit in Lucee Admin
published 2021-02-11 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-8661
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 89.2%
- EPSS 89.2% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.
Patch / fix
- lucee lucee_server 5.3.5.96, 5.3.6.68, 5.3.7.47
Timeline
- First public exploit (Metasploit exploit/linux/http/lucee_admin_imgprocess_file_write)
- Published
Exploit prediction
89.19% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/lucee_admin_imgprocess_file_write Lucee Administrator imgProcess.cfm Arbitrary File Write metasploit exploit, excellent rank, 2021-01-15
- Nuclei template Lucee Admin - Remote Code Execution nuclei detection template
- github.com https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md referenced PoC, tagged "exploit" by a source, unverified
- packetstormsecurity.com http://packetstormsecurity.com/files/163864/Lucee-Administrator-imgProcess.cfm-Arbitrary-File-Write.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- lucee Lucee
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/lucee/Lucee/commit/6208ab7c44c61d26c79e0b0af10382899f57e1ca
patch, third-party-advisory
-
ciacfug.org
/blog/updating-lucee-as-part-of-a-vulnerability-alert-response
patch, third-party-advisory
-
github.com
/httpvoid/writeups/blob/main/Apple-RCE.md
exploit, third-party-advisory
-
packetstormsecurity.com
/files/163864/Lucee-Administrator-imgProcess.cfm-Arbitrary-File-Write.html
exploit, third-party-advisory, vdb-entry
-
dev.lucee.org
/t/lucee-vulnerability-alert-november-2020/7643
vendor-advisory
-
github.com
/lucee/Lucee/security/advisories/GHSA-2xvv-723c-8p7r
product
-
portswigger.net
/daily-swig/security-researchers-earn-50k-after-exposing-critical-flaw-in-apple-travel-portal
press/media-coverage, third-party-advisory
Sources
- CVE List CVE-2021-21307
- NVD CVE-2021-21307
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.