Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 19:45:49 +0000 CVE-2017-12635 https://vulnerability.circl.lu/vuln/cve-2017-12635 <p><strong>Affected:</strong> Apache Software Foundation Apache CouchDB</p> <p>Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for &#39;roles&#39; used for access control within the database, including the special case &#39;_admin&#39; role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two &#39;roles&#39; keys are available in the JSON, the second one will be used for authorising the document write, but the first &#39;roles&#39; key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache CouchDB</p> <p>Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for &#39;roles&#39; used for access control within the database, including the special case &#39;_admin&#39; role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two &#39;roles&#39; keys are available in the JSON, the second one will be used for authorising the document write, but the first &#39;roles&#39; key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.</p> https://vulnerability.circl.lu/vuln/cve-2017-12635