CVE-2021-38295

CVE-2021-38295 affects Apache CouchDB before 3.1.2. A malicious user who can create documents can attach an HTML file; when an admin opens the attachment in a browser (e.g., Fauxton) the embedded JavaScript runs in the admin’s security context, enabling privilege escalation. Affected routes inclu...

CVE-2018-17188

Apache CouchDB CVE-2018-17188 affects prior to v2.3.0, where runtime-configuration of key components could let CouchDB admin users access the underlying OS as the CouchDB user. This vulnerability, together with others, could enable full system entry for unauthenticated users. Evidence in connecte...

CVE-2018-14889

CVE-2018-14889 affects CouchDB in Vectra Networks Cognito Brain and Sensor prior to version 4.3, described as a local code execution vulnerability . The available data show a local attack with partial impact on confidentiality, integrity, and availability (CVSS2: 4.6 MEDIUM; CVSS3: 7.8 HIGH); exp...

CVE-2016-8742

CVE-2016-8742 affects CouchDB 2.0.0 on Windows where the Windows installer inherited the parent directory’s permissions, allowing a non-privileged user to substitute executables for nssm.exe or CouchDB launcher files. A restart then executes the tainted binary with administrator privileges, enabl...