PT-2025-15664 · Lucee · Lucee

Published 2025-04-08 · Updated 2025-06-25 · CVE-2024-55354

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Lucee versions prior to 5.4.7.3 LTS Lucee versions prior to 6.1.1.118

Description: The issue is related to a protection mechanism failure. When an attacker can place files on the server, this failure can allow the attacker to run code that would be expected to be blocked and access resources that would be expected to be protected.

Recommendations: For versions prior to 5.4.7.3 LTS, update to version 5.4.7.3 LTS or later. For versions prior to 6.1.1.118, update to version 6.1.1.118 or later.

Fix

Weakness Enumeration

CWE-807

Related Identifiers

CVE-2024-55354

Affected Products

Lucee

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-55354 · Security Note
• https://twitter.com/hoyahaxa/status/1937836293595267127 · Twitter Post
• https://twitter.com/lucee_server/status/1909910371311165571 · Twitter Post
• https://t.me/cvenotify/118549 · Telegram Post
• https://twitter.com/hoyahaxa/status/1937838346375454767 · Twitter Post
• https://t.me/cvedetector/22533 · Telegram Post
• https://twitter.com/CVEnew/status/1909923474032021632 · Twitter Post
• https://dev.lucee.org/t/lucee-cve-2024-55354-security-advisory-april-2025/14963 · Note
• https://t.me/cvetracker/21191 · Telegram Post
• https://t.me/cvenotify/118386 · Telegram Post