Back
CVE-2017-12636
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating…
High7.2EPSS 90.6%
- Published
- Updated
- Reserved
- Assigned by
- apache
Description
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 90.6% · top 0.2% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.
Weakness
- Information Disclosure
- CWE-78 (opens in a new tab)All about CWE-78 and its CVEs
Affected products
Apache Software Foundation · Apache CouchDB
- affected 1.2.0 to 1.6.1
- affected 2.0.0 to 2.1.0
References (6)
- 45019 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred
- [dev] 20171114 Apache CouchDB CVE-2017-12635 and CVE-2017-12636 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- 44913 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred
- GLSA-201711-16 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
- [debian-lts-announce] 20180121 [SECURITY] [DLA 1252-1] couchdb security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-12636)Record last updated .