XSS in Apache Couchdb
CVE-2021-38295
In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.025 (83.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Apache Couchdb
- Apache Software Foundation Couchdb — versions Apache CouchDB
- Apache Software Foundation Ibm Cloudant — versions IBM Cloudant
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-38295?
- CVE-2021-38295 is a high-severity vulnerability in Apache Couchdb, classified under Cross-site Scripting. CVSS score: 7.3/10. Published 2021-10-14.
- How severe is CVE-2021-38295?
- High severity. CVSS v3 base score is 7.3 out of 10.
- Is CVE-2021-38295 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.