Apache Software Foundation Apache Couchdb
10 CVEs affecting Apache Software Foundation Apache Couchdb. Latest disclosed: 2023-12-13. Critical: 2, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24706 | Critical | 9.8 | 2022-04-26 | In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The Couch… |
CVE-2017-12635 | Critical | 9.8 | 2017-11-14 | Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to subm… |
CVE-2016-8742 | High | 7.8 | 2018-02-12 | The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit the file permissions… |
CVE-2021-38295 | High | 7.3 | 2021-10-14 | In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin ope… |
CVE-2018-17188 | High | 7.2 | 2019-01-02 | Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where… |
CVE-2018-11769 | High | 7.2 | 2018-08-08 | CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration… |
CVE-2018-8007 | High | 7.2 | 2018-07-11 | Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration setti… |
CVE-2017-12636 | High | 7.2 | 2017-11-14 | CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries… |
CVE-2023-45725 | Medium | 5.7 | 2023-12-13 | Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. T… |
CVE-2023-26268 | Medium | 4.4 | 2023-05-02 | Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document fu… |