CVE-2024-55354

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let an attacker run code that would be expected to be blocked and access resources that would be expected to be protected.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-807

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-55365.4The GamiPress – Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gamipress_link shortcode in all vers CVE-2024-553719.8Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uplo CVE-2024-553729.8Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by CVE-2024-553745.3REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.CVE-2024-55399.2The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor t CVE-2024-553986.54C Strategies Exonaut before v22.4 was discovered to contain insecure permissions.CVE-2024-553996.54C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF).CVE-2024-55406.9The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allo CVE-2024-554016.5An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal.CVE-2024-554025.34C Strategies Exonaut before v22.4 was discovered to contain an access control issue.CVE-2024-554077.8An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write a CVE-2024-554085.3An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver wh