CVE-2021-21307

CRITICAL 9.8CVE-2021-21307 · Published 11/02/2021 · updated 17/06/2026

In short

CVE-2021-21307 is a CRITICAL (CVSS 9.8) vulnerability affecting lucee server (lucee).
Chance of exploitation in the next 30 days (EPSS): 89.2%, higher than 99.8% of all vulnerabilities.
Fix: update to 5.3.5.96, 5.3.6.68, 5.3.7.47 or later.

Package	Affected versions	Patched versions
lucee server lucee	`≥ 5.3.5.00, < 5.3.5.96≥ 5.3.6.00, < 5.3.6.68≥ 5.3.7.00, < 5.3.7.47`	`5.3.5.965.3.6.685.3.7.47`

Description

Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.

References

ciacfug.org/blog/updating-lucee-as-part-of-a-vulnerability-alert-response · Patch
packetstormsecurity.com/files/163864/Lucee-Administrator-imgProcess.cfm-Arbitrary-File-Write.html · Exploit
dev.lucee.org/t/lucee-vulnerability-alert-november-2020/7643 · Vendor Advisory
httpvoid/writeups · Exploit
lucee/Lucee commit 6208ab7 · Patch
lucee/Lucee security advisory · Product
portswigger.net/daily-swig/security-researchers-earn-50k-after-exposing-critical-flaw-in-apple-travel-portal · Press/Media Coverage

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free