Vulnerability identifier: #VU84347
Vulnerability risk: Medium
CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-94
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
CouchDB
Server applications /
Database software
Vendor: Apache Foundation
Description
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to improper input validation. A remote user with access to design
documents can insert specially crafted HTML code into the database and gain access to authorization or session cookie headers when the victim opens the design documents.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
CouchDB: 3.0.0 - 3.3.2
External links
http://docs.couchdb.org/en/stable/cve/2023-45725.html
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.