PT-2014-2347 · Apache+1 · Apache Couchdb+1

Melkote · Published 2014-03-18 · Updated 2017-08-29 · CVE-2012-5641

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MochiWeb versions prior to 2.4.0 Apache CouchDB versions prior to 1.0.4 Apache CouchDB versions 1.1.x prior to 1.1.2 Apache CouchDB versions 1.2.x prior to 1.2.1

Description A directory traversal issue exists in the partition2 function in mochiweb util.erl in MochiWeb, which is used in Apache CouchDB. This issue allows remote attackers to read arbitrary files by including a .. (dot dot backslash) in the default URI.

Recommendations For MochiWeb versions prior to 2.4.0, update to version 2.4.0 or later. For Apache CouchDB versions prior to 1.0.4, update to version 1.0.4 or later. For Apache CouchDB versions 1.1.x prior to 1.1.2, update to version 1.1.2 or later. For Apache CouchDB versions 1.2.x prior to 1.2.1, update to version 1.2.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2012-5641

Affected Products

Apache Couchdb

Mochiweb

References · 8

• 🔥❌ https://github.com/melkote/mochiweb/commit/ac2bf · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2012-5641 · Security Note
• https://github.com/mochi/mochiweb/issues/92 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5641 · Note
• http://securityfocus.com/bid/57313 · Note
• http://secunia.com/advisories/51765 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/81240 · Note
• http://seclists.org/fulldisclosure/2013/Jan/81 · Note