Description lucee服务器(简称lucee)是一种动态的、基于java的标记和脚本语言,用于快速的web应用程序开发。其旧版本某些文件存在未授权访问,攻击者可构造恶意请求造成远程代码执行。
References https://avd.aliyun.com/detail?id=AVD-2021-21307 https://www.sentinelone.com/vulnerability-database/cve-2021-21307/ https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21307.yaml https://ine.com/blog/cve-2021-21307-lucee-server-arbitrary-file-write https://dev.lucee.org/t/lucee-vulnerability-alert-november-2020-cve-2021-21307/7643 https://www.rapid7.com/db/vulnerabilities/http-lucee-admin-cve-2021-21307/ https://nvd.nist.gov/vuln/detail/CVE-2021-21307 https://github.com/lucee/Lucee/security/advisories/GHSA-2xvv-723c-8p7r https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md https://zone.ci/aliyun/ali_highrisk/11639.html
Related Vulnerabilities中科商软云连ERP /admin/session!ajaxList.action 未授权访问漏洞PoCCVE-2026-80099: Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC SecretPoCCVE-2026-2113: tpadmin <= 1.3.12 - Remote Code ExecutionPoCnacos-v3-auth-scope-bypass: Nacos 3.x - Unauthenticated Admin Takeovertpadmin存在远程代码执行漏洞(CVE-2026-2113)PoCCVE-2026-19598: Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX RouterPoCCVE-2026-55224: MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCEPoCCVE-2025-13342: DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options UpdatePoCCVE-2026-34976: Dgraph <=v25.3.0 - Admin Mutation Missing AuthorizationPoCCVE-2026-45332: Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash DisclosureCisco ISE /admin/files-upload/ 文件上传漏洞(CVE-2025-20282)PoCCVE-2026-8732: WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account CreationPoCNginxWebUI /adminPage/login/getAuth 命令执行漏洞