CVE-2023-38693: Lucee RCE/XXE Vulnerability

March 5, 2025

The Lucee team received a responsible disclosure of a security vulnerability which affects all previous releases of Lucee.

After reviewing the report and confirming the vulnerability, the Lucee team then conducted a further security review and found additional vulnerabilities which have been addressed as part of this this security update.

References

github.com/advisories/GHSA-vwjx-mmwm-pwrf
github.com/lucee/Lucee
github.com/lucee/Lucee/security/advisories/GHSA-vwjx-mmwm-pwrf
nvd.nist.gov/vuln/detail/CVE-2023-38693

Code Behaviors & Features

Detect and mitigate CVE-2023-38693 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →