10

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-38693

GHSA ID

GHSA-vwjx-mmwm-pwrf

EPSS Score

0.34702%

CWE

CWE-611

Published

3/5/2025

Updated

3/5/2025

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-38693

CVE-2023-38693: Lucee RCE/XXE Vulnerability

Impact

The Lucee team received a responsible disclosure of a security vulnerability which affects all previous releases of Lucee.

After reviewing the report and confirming the vulnerability, the Lucee team then conducted a further security review and found additional vulnerabilities which have been addressed as part of this this security update.

Patches

Lucee 5.4.3.2 and 5.3.12.1 stable releases have been patched with additional hardening

The older releases, 5.3.7.59., 5.3.8.236 and 5.3.9.173 have also been patched

Any users running older release, should plan to immediately upgrade to the latest stable release

6.0 will have a RC as it's not yet released

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-38693

CVE-2023-38693:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-38693

GHSA ID

GHSA-vwjx-mmwm-pwrf

EPSS Score

0.34702%

CWE

CWE-611

Published

3/5/2025

Updated

3/5/2025

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.lucee:lucee	maven	>= 5.3.10.79-RC, < 5.3.12.1	5.3.12.1
org.lucee:lucee	maven	>= 5.4.0.65-RC, < 5.4.3.2	5.4.3.2
org.lucee:lucee	maven	<= 5.3.7.59
org.lucee:lucee	maven	>= 5.3.8.132-RC, < 5.3.8.236	5.3.8.236
org.lucee:lucee	maven	>= 5.3.9.113, < 5.3.9.173	5.3.9.173

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

10

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-38693: Lucee RCE/XXE Vulnerability

Impact

Patches

CVE-2023-38693:

10

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

CVE-2023-38693: Lucee RCE/XXE Vulnerability

Impact

Patches

Technical Details

10

10

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI