Apache CouchDB vulnerabilities
3 known CVE vulnerabilities in Apache CouchDB, translated and rated.
- CVE-2017-12636High
CouchDB administrative users can configure the database server via HTTP(S), allowing them to specify paths for operating system-level binaries. This enables the CouchDB user to execute arbitrary shell commands, including downloading and executing scripts from the public internet.
- CVE-2022-24706CriticalActively exploited
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The documentation has always recommended proper security measures, including a firewall.
- CVE-2017-12635Critical
In Apache CouchDB before version 1.7.0 and 2.x before version 2.1.1, a vulnerability allows submitting _users documents with duplicate 'roles' keys, which can lead to non-admin users being granted admin privileges.