CVE-2017-12636

High

Description

CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.

SeverityHigh

CVSS7.2

Exploit probability—

Product

Apache Couchdb

PublishedNov 14, 2017

First seenNov 14, 2017

How to fix

Update

apache couchdb1.7.0 or later

Vendor advisories

security.gentoo.org/glsa/201711-16

Affected products

Product	Affected versions	Fixed in
apache couchdb	v < 1.7.0, 2.0.0	1.7.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.