CVE-2023-53880
Lucee 5.4.2.17 Authenticated Reflected Cross-Site Scripting via Admin Interfaces
MEDIUM 4.8EPSS 0.3%
Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters. Attackers can craft specific payloads targeting admin pages like server.cfm and web.cfm to execute arbitrary JavaScript in victim's browser sessions.
- Affected
- Lucee
- CVSS v4.0 VULNCHECK
- 4.8 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS
- 0.34% chance of exploitation in the next 30 days, 26th percentile
- Published
- 2025-12-15
- Updated
- 2026-04-07