PT-2021-22017 · Apache · Apache Couchdb

Cory Sabol · Published 2021-10-14 · Updated 2024-03-06 · CVE-2021-38295

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache CouchDB versions prior to 3.1.2

Description: A malicious user with permission to create documents in a database can attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. This issue allows an attacker to add or remove data in any database or make configuration changes.

Recommendations: For versions prior to 3.1.2, update to version 3.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to HTML attachments in the CouchDB admin interface Fauxton to minimize the risk of exploitation. Avoid using the deprecated show and list functionality until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-COUCHDB-2021-38295

CVE-2021-38295

MGASA-2021-0520

Affected Products

Apache Couchdb

References · 16

• 🔥 https://github.com/ProfessionallyEvil/CVE-2021-38295-PoC · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38295 · Vendor Advisory
• https://docs.couchdb.org/en/stable/cve/2021-38295.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38295 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38295 · Security Note
• https://advisories.mageia.org/MGASA-2021-0520.html · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0520 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38295 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-38295 · Security Note
• https://osv.dev/vulnerability/BIT-couchdb-2021-38295 · Vendor Advisory
• https://t.me/cibsecurity/30603 · Telegram Post
• https://t.me/ckure/9761 · Telegram Post
• https://openwall.com/lists/oss-security/2021/10/12/2 · Note
• https://bugs.mageia.org/show_bug.cgi?id=29548 · Note
• https://t.me/freedomf0x/14336 · Telegram Post