CVE-2023-53880
Reflected XSS in Lucee 5.4.2.17 Admin Interface
Publication date: 2025-12-15
Last updated on: 2025-12-15
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lucee | lucee | 5.4.2.17 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2023-53880 is a reflected cross-site scripting (XSS) vulnerability in Lucee version 5.4.2.17. It allows authenticated attackers to inject malicious JavaScript code through parameters in the administrative interface pages like server.cfm and web.cfm. When a victim accesses a crafted URL or interface containing the malicious script, the script executes in their browser session, potentially enabling actions like session hijacking or stealing credentials. [2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker with valid credentials to inject malicious scripts into the administrative interface of Lucee. These scripts can execute in the browsers of users who access the affected pages, potentially leading to session hijacking, theft of login credentials, or other malicious actions that compromise the security of your web application and user data. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing for reflected XSS in the administrative interface pages such as server.cfm and web.cfm. Specifically, you can attempt to send crafted payloads in parameters like 'custom_component' via POST requests to endpoints such as /lucee/admin/web.cfm?action=services.gateway&action2=create. For example, using curl to send a POST request with an XSS payload can help detect the vulnerability: curl -X POST -d "custom_component=<img src=x onerror=alert('xss')>" https://your-lucee-server/lucee/admin/web.cfm?action=services.gateway&action2=create -b cookies.txt -c cookies.txt. Note that authentication is required, so you must include valid session cookies or credentials. Monitoring for reflected script execution in the browser after such requests indicates the presence of the vulnerability. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the administrative interface to trusted users only, ensuring strong authentication controls are in place, and avoiding clicking on suspicious links that may contain malicious payloads. Since the vulnerability requires authenticated access, limiting user privileges can reduce risk. Additionally, updating Lucee to a version later than 5.4.2.17 (if available) or applying any vendor-provided patches is recommended. Implementing web application firewall (WAF) rules to detect and block reflected XSS payloads targeting the admin pages can also help mitigate exploitation. [2, 3]