CVE-2017-12636
CVE-2017-12636
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
CVSS 7.2 · Alta · EPSS 90,6% · Código de explotación público
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
apache couchdb
- Versiones
- 1.2.0 to 1.6.1: Afectada
- 2.0.0 to 2.1.0: Afectada
Sin corrección publicada
couchdb Ubuntu:16.04:LTS
- Versiones
- 1.6.0-0ubuntu7
- Intervalos de versiones afectados
- ECOSYSTEM: (−∞, +∞)
Sin corrección publicada
Fuentes originales
- https://www.exploit-db.com/exploits/45019/
- https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E
- https://www.exploit-db.com/exploits/44913/
- https://security.gentoo.org/glsa/201711-16
- https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us
- https://nvd.nist.gov/vuln/detail/CVE-2017-12636