Here’s info on newly discovered sql injection vulns found in Masa and Mura, which (before being revealed publicly) have been fixed by the Masa team though not yet by the Mura team (after 90 days of the researcher attempting to reach them).
More here:
Despite the title, it’s not at all specific to Apple. It’s just that Apple is running Mura (or Masa–it’s not clear), and they are running it on Lucee. FWIW, it would seem the issue is not specific to Lucee, either.
But I will leave others to sort things out. I just wanted to bring it to the attention of folks here, as I got notified just now of this post.
If you’re running Masa, you’ll want to get the update that resolves the issue. If you’re running Mura, you’ll want to bring this to the attention of your Mura contacts to try to get resolution from them–or if you may have the Mura source, perhaps you can compare your code to what’s reported here and fixed by Masa.