High severity · published Nov 14, 2017
CVE-2017-12636
CouchDB administrative users can configure the database server via HTTP(S)
7.2
CVSS
90.6%
EPSS
No
On KEV
Description
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)90.6% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Couchdb · Apache
before 1.7.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12636
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12636
lists.apache.org
https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E
lists.debian.org
https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html
Third Party Advisory
https://security.gentoo.org/glsa/201711-16
support.hpe.com
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us
www.exploit-db.com
https://www.exploit-db.com/exploits/44913/
www.exploit-db.com
https://www.exploit-db.com/exploits/45019/
More from Couchdb
9.8
CVE-2022-24706
Remote Code Execution Vulnerability in Packaging
9.8
CVE-2020-1955
CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_up`
9.8
CVE-2017-12635
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents…
7.8
CVE-2018-14889
CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability
7.8
CVE-2016-8742
The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation