CVE-2018-8007

Severity Score

7.2

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows an existing CouchDB admin user to gain arbitrary remote code execution, bypassing already disclosed CVE-2017-12636. Mitigation: All users should upgrade to CouchDB releases 1.7.2 or 2.1.2.

Los usuarios administrativos de Apache CouchDB pueden configurar el servidor de la base de datos mediante HTTP(S). Debido a la validación insuficiente de las opciones de configuración proporcionadas por el administrador mediante la API HTTP, es posible que un usuario administrador de CouchDB escale sus privilegios a los del usuario del sistema operativo bajo el que se ejecuta CouchDB. Esto se realiza mediante la omisión de la lista negra de opciones de configuración que no pueden ser modificadas mediante la API HTTP. Este escalado de privilegios permite que un usuario admin de CouchDB existente pueda ejecutar código de forma remota mediante la omisión del CVE-2017-12636 ya revelado. Mitigación: todos los usuarios deberían actualizar a CouchDB en versiones 1.7.2 o 2.1.2.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-03-09 CVE Reserved
2018-07-11 CVE Published
2024-06-19 EPSS Updated
2024-09-16 CVE Updated
2024-09-16 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-20: Improper Input Validation

CAPEC

References (9)

URL	Tag	Source
http://mail-archives.apache.org/mod_mbox/couchdb-announce/201807.mbox/%3C1699016538.6219.1531246785603.JavaMail.Joan%40RITA%3E	Mailing List
http://mail-archives.apache.org/mod_mbox/couchdb-announce/201807.mbox/%3c1439409216.6221.1531246856676.JavaMail.Joan%40RITA%3e	Mailing List
http://www.securityfocus.com/bid/104741	Third Party Advisory
https://blog.couchdb.org/2018/07/10/cve-2018-8007	Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us	X_refsource_confirm

URL	Date	SRC
https://www.mdsec.co.uk/2018/08/advisory-cve-2018-8007-apache-couchdb-remote-code-execution	2024-09-16

URL	Date	SRC

URL	Date	SRC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5FPHVVU5KMRFKQTJPAM3TBGC7LKCWQS	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JOUCX7LHDV4YWZDQNXT5NTKKRANZQW	2023-11-07
https://security.gentoo.org/glsa/201812-06	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Couchdb Search vendor "Apache" for product "Couchdb"				<= 1.7.1 Search vendor "Apache" for product "Couchdb" and version " <= 1.7.1"		-		Affected
Apache Search vendor "Apache"		Couchdb Search vendor "Apache" for product "Couchdb"				>= 2.0.0 <= 2.1.1 Search vendor "Apache" for product "Couchdb" and version " >= 2.0.0 <= 2.1.1"		-		Affected