CVE-2021-21307

🗓️ 11 Feb 2021 18:20:21Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 319 Views🌐 WEB

Lucee Server unauthenticated remote code exploit fix in versions 5.3.7.47, 5.3.6.68, or 5.3.5.9

Reporter	Title	Published	Views	Family All 22
zdt	Lucee Administrator imgProcess.cfm Arbitrary File Write Exploit	18 Aug 202100:00	–	zdt
attackerkb	CVE-2021-21307	11 Feb 202119:15	–	attackerkb
Circl	CVE-2021-21307	11 Feb 202122:54	–	circl
CNNVD	Lucee Server Authorization Issues Vulnerability	11 Feb 202100:00	–	cnnvd
Cvelist	CVE-2021-21307 Remote Code Exploit in Lucee Admin	11 Feb 202118:20	–	cvelist
KittySploit	Lucee - imgProcess.cfm Unauthenticated RCE (CVE-2021-21307)	10 Aug 202606:19	–	kittysploit
KittySploit	Lucee - imgProcess.cfm Unauth Access Detection (CVE-2021-21307)	10 Aug 202606:19	–	kittysploit
Mend	CVE-2021-21307	11 Feb 202118:20	–	mend
Metasploit	Lucee Administrator imgProcess.cfm Arbitrary File Write	15 Jan 202100:00	–	metasploit
Nuclei	Lucee Admin - Remote Code Execution	29 Oct 202602:04	–	nuclei

NVD

Node

lucee lucee_serverRange5.3.5.00–5.3.5.96

lucee lucee_serverRange5.3.6.00–5.3.6.68

lucee lucee_serverRange5.3.7.00–5.3.7.47

[
  {
    "product": "Lucee",
    "vendor": "lucee",
    "versions": [
      {
        "status": "affected",
        "version": ">= 5.3.5.0, < 5.3.5.96"
      },
      {
        "status": "affected",
        "version": ">= 5.3.6.0, < 5.3.6.68"
      },
      {
        "status": "affected",
        "version": ">= 5.3.7.0, < 5.3.7.47"
      }
    ]
  }
]

Source	Link
ciacfug	www.ciacfug.org/blog/updating-lucee-as-part-of-a-vulnerability-alert-response
packetstormsecurity	www.packetstormsecurity.com/files/163864/Lucee-Administrator-imgProcess.cfm-Arbitrary-File-Write.html
github	www.github.com/lucee/Lucee/security/advisories/GHSA-2xvv-723c-8p7r
github	www.github.com/httpvoid/writeups/blob/main/Apple-RCE.md
dev	www.dev.lucee.org/t/lucee-vulnerability-alert-november-2020/7643
github	www.github.com/lucee/Lucee/commit/6208ab7c44c61d26c79e0b0af10382899f57e1ca
portswigger	www.portswigger.net/daily-swig/security-researchers-earn-50k-after-exposing-critical-flaw-in-apple-travel-portal

Parameter	Position	Path	Description	CWE
file	query param	/lucee/admin/imgProcess.cfm	Path traversal vulnerability via query parameter 'file' in imgProcess.cfm leading to file creation on the server.	CWE-862
imgSrc	request body	/lucee/admin/imgProcess.cfm	Post parameter used to define content for file created by path traversal in Lucee's imgProcess.cfm.	CWE-862
dataDir	query param	/lucee/admin/admin.search.index.cfm	Allows copying of files from a source directory to a target and triggers listing/processing of CFML files; can be abused for pre-auth RCE via manipulating dataDir and LUCEEARCHIVEZIPPATH.	CWE-862
LUCEEARCHIVEZIPPATH	query param	/lucee/admin/admin.search.index.cfm	Allows copying of files from a source directory to a target and triggers listing/processing of CFML files; can be abused for pre-auth RCE via manipulating dataDir and LUCEEARCHIVEZIPPATH.	CWE-862
extfile	upload data	/lucee/admin/ext.applications.upload.cfm	Unauthenticated/partial upload of .lex (Lucee extension) leading to ZIP containing a crafted server.<cffile action=write...> file to achieve RCE.	CWE-862
f	query param	/lucee/rootxharsh/searchindex.cfm	Webshell endpoint created via exploitation chain, demonstrating post-exploitation access to the server.	CWE-862
content	query param	/lucee/rootxharsh/searchindex.cfm	Webshell endpoint created via exploitation chain, demonstrating post-exploitation access to the server.	CWE-862

17 Jun 2026 03:35Current

9Critical risk

Vulners AI Score9

CVSS 27.5

CVSS 3.18.6 - 9.8

EPSS0.89189