CVE-2023-38693 RCE in Lucee REST endpoint
Attackers can achieve remote code execution via XML External Entity injection in the Lucee REST endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-38693?
CVE-2023-38693 is a critical vulnerability in Lucee, published on 5 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173.
Weakness: CWE-611
Which versions are affected by CVE-2023-38693?
10 open source packages ship an affected version, including org.lucee:lucee.
| Package | Affected | Fixed in |
|---|---|---|
org.lucee:lucee Maven | All versions to 5.3.7.59 | None |
org.lucee:lucee Maven | All versions to 5.3.7.59 | None |
org.lucee:lucee Maven | From 5.3.10.79-RC | 5.3.12.1 |
org.lucee:lucee Maven | From 5.3.10.79-RC | 5.3.12.1 |
org.lucee:lucee Maven | From 5.3.8.132-RC | 5.3.8.236 |
org.lucee:lucee Maven | From 5.3.8.132-RC | 5.3.8.236 |
4 more packages
org.lucee:lucee Maven | From 5.3.9.113 | 5.3.9.173 |
org.lucee:lucee Maven | From 5.3.9.113 | 5.3.9.173 |
org.lucee:lucee Maven | From 5.4.0.65-RC | 5.4.3.2 |
org.lucee:lucee Maven | From 5.4.0.65-RC | 5.4.3.2 |
How do I fix CVE-2023-38693?
Upgrade org.lucee:lucee to a fixed version for your release line: 5.3.12.1, 5.3.8.236, 5.3.9.173 or 5.4.3.2.
Is CVE-2023-38693 being exploited?
There is no known exploitation of CVE-2023-38693 in the wild and no public exploit code.
Sources
Also known as GHSA-vwjx-mmwm-pwrf.