Authenticated script execution via unencoded admin parameters

Reflected XSS in Lucee 5.4.2.17 allows remote authenticated users to execute JavaScript in an administrator's browser via crafted admin requests. The server.cfm action parameter and web.cfm gateway custom_component field accept HTML event-handler payloads that the administrative pages return without safe output encoding. A valid administrative session and victim interaction are required; successful exploitation runs attacker-supplied script in the victim's Lucee origin, enabling session or credential theft and administrative actions available to that browser.