Login Request a demo
High severity · published Aug 8, 2018
CVE-2018-11769
CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S)
7.2
CVSS
8.4%
EPSS
No
On KEV
Description
CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.4% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Apache CouchDB · Apache Software Foundation
Apache Tomcat 1.x and =2.1.2 · source: vendor
CO
Couchdb · Apache
before 2.2.0 · source: NVD
Affected product
AC
Apache CouchDB
Apache Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11769
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11769
Third Party Advisory
http://www.securityfocus.com/bid/105046
lists.apache.org
https://lists.apache.org/thread.html/1052ad7a1b32b9756df4f7860f5cb5a96b739f444117325a19a4bf75%40%3Cdev.couchdb.apache.org%3E
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5FPHVVU5KMRFKQTJPAM3TBGC7LKCWQS/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JOUCX7LHDV4YWZDQNXT5NTKKRANZQW/
Third Party Advisory
https://security.gentoo.org/glsa/201812-06
support.hpe.com
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us
More from Apache CouchDB
9.8
CVE-2022-24706
Remote Code Execution Vulnerability in Packaging
9.3
CVE-2026-86471
Apache CouchDB: Admin credentials leading to code execution as operating system user
8.1
CVE-2026-90800
Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
7.7
CVE-2026-90797
Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
6.0
CVE-2026-107755
Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs