Back to search
CVE-2017-12636
Published: Nov 14, 2017
Modified: Sep 16, 2024
PUBLISHED
Description
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
| Vendor | Product | Versions |
|---|---|---|
Apache Software Foundation | Apache CouchDB | affected 1.2.0 to 1.6.1affected 2.0.0 to 2.1.0 |
References
45019
exploit
x_refsource_EXPLOIT-DB
[dev] 20171114 Apache CouchDB CVE-2017-12635 and CVE-2017-12636
mailing-list
x_refsource_MLIST
44913
exploit
x_refsource_EXPLOIT-DB
GLSA-201711-16
vendor-advisory
x_refsource_GENTOO
[debian-lts-announce] 20180121 [SECURITY] [DLA 1252-1] couchdb security update
mailing-list
x_refsource_MLIST
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now