QID 731127

Date Published: 2024-02-08

QID 731127: Apache CouchDB Information Disclosure Vulnerability

Apache CouchDB is a free open source document-oriented database written in the Erlang programming language.

Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: validate_doc_update, list, filter, filter views (using view functions as filters), rewrite, update. This doesn't affect map/reduce or search (Dreyfus) index functions.

Affected Versions:
Apache CouchDB versions prior to version 3.2.3
Apache CouchDB versions 3.3.0 and 3.3.1

QID Detection Logic(Remote)
It checks for vulnerable version of Apache CouchDB by sending a GET request to the target and matches the vulnerable version.

Note: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.

Successful exploitation of this vulnerability can disclose sensitive information.

CVSS V3 rated as Medium - 5.3 severity.

CVSS V2 rated as Low - 1.3 severity.

Solution

The vendor has already released the patch to fix the vulnerability. Customers are advised to upgrade to Apache CouchDB.Workaround:
Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.

Vendor References

Apache CouchDB Information Disclosure - docs.couchdb.org/en/stable/cve/2023-26268.html

CVEs related to QID 731127

CVE-2023-26268 |

Software Advisories

Advisory ID	Software	Component	Link
Apache CouchDB			couchdb.apache.org/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].