Apache couchdb

This hub aggregates every CVE we track for Apache couchdb, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 9 most recently published vulnerabilities affecting Apache couchdb.

• CVE-2023-45725Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents5.7Dec 13, 2023
• CVE-2022-24706Remote Code Execution Vulnerability in PackagingKEV9.8Apr 26, 2022
• CVE-2021-38295Privilege escalation vulnerability when using HTML attachments7.3Oct 14, 2021
• CVE-2018-17188Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the u...7.2Jan 2, 2019
• CVE-2018-11769CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is poss...7.2Aug 8, 2018
• CVE-2018-8007Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible f...7.2Jul 11, 2018
• CVE-2016-8742The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit the file permissions of the parent directory and therefore...7.8Feb 12, 2018
• CVE-2017-12635Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate key...9.8Nov 14, 2017
• CVE-2017-12636CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by Cou...7.2Nov 14, 2017