Description
Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development.
Lucee Server versions older than 5.3.8.89 allow attackers to access authenticated CFM (ColdFusion) files directly. This allowed atackers to perform a lot of authenticated actions while being completely unauthenticated.
The file imgProcess.cfm is vulnerable to a path traversal vulnerability that allows an attacker to create a file anywhere on the server with attacker-controlled content. This can be easily escalated in RCE (Remote Code Execution) by creating malicious .cfm files.
Remediation
Upgrade to the latest version of Lucee Server to fix this issue.