CyberRota Analysis
AI-GeneratedLucee CFML Server versions 5.3.x, 6.1.x, 6.2.x, and 7.0.x are vulnerable to a reflected cross-site scripting (XSS) flaw that allows unauthenticated attackers to execute arbitrary JavaScript in users' browsers via crafted URLs. This vulnerability can lead to session hijacking or unauthorized actions against the Lucee administrative interface. Organizations using affected versions should prioritize remediation to protect against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads within the request path. Attackers can craft a malicious URL containing injected script content that is reflected in the server's response without proper output encoding, enabling session hijacking or unauthorized actions against the Lucee administrative interface when a victim visits the crafted link.