PT-2020-15189 · Apache · Couchdb

Published 2020-05-20 · Updated 2024-03-06 · CVE-2020-1955

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CouchDB version 3.0.0

Description The issue concerns a new configuration setting require valid user except for up in CouchDB, intended to extend the require valid user setting by allowing anonymous requests to the / up endpoint. However, due to an implementation error, enabling this setting results in not enforcing credentials on any endpoint. This affects the security of the database server by allowing unauthorized access.

Recommendations For CouchDB version 3.0.0, update to version 3.0.1 or 3.1.0 to resolve the issue. As a temporary workaround, consider disabling the require valid user except for up setting until the update is applied. Restrict access to the database server to minimize the risk of exploitation. Avoid using the / up endpoint with anonymous requests until the issue is resolved.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BIT-COUCHDB-2020-1955

CVE-2020-1955

Affected Products

Couchdb

References · 5

• https://docs.couchdb.org/en/master/cve/2020-1955.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-couchdb-2020-1955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1955 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1955 · Vendor Advisory
• https://t.me/cvenotify/3941 · Telegram Post