CVE-2017-12636 (GCVE-0-2017-12636)

Vulnerability from cvelistv5 – Published: 2017-11-14 20:00 – Updated: 2024-09-16 18:48
VLAI?
Summary
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
Severity ?
No CVSS data available.
CWE
  • Information Disclosure
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache CouchDB Affected: 1.2.0 to 1.6.1
Affected: 2.0.0 to 2.1.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T18:43:56.454Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "45019",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/45019/"
          },
          {
            "name": "[dev] 20171114 Apache CouchDB CVE-2017-12635 and CVE-2017-12636",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E"
          },
          {
            "name": "44913",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44913/"
          },
          {
            "name": "GLSA-201711-16",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201711-16"
          },
          {
            "name": "[debian-lts-announce] 20180121 [SECURITY] [DLA 1252-1] couchdb security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbmu03935en_us"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache CouchDB",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.0 to 1.6.1"
            },
            {
              "status": "affected",
              "version": "2.0.0 to 2.1.0"
            }
          ]
        }
      ],
      "datePublic": "2017-11-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-05-13T18:06:10",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "45019",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/45019/"
        },
        {
          "name": "[dev] 20171114 Apache CouchDB CVE-2017-12635 and CVE-2017-12636",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E"
        },
        {
          "name": "44913",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44913/"
        },
        {
          "name": "GLSA-201711-16",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201711-16"
        },
        {
          "name": "[debian-lts-announce] 20180121 [SECURITY] [DLA 1252-1] couchdb security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbmu03935en_us"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "DATE_PUBLIC": "2017-11-14T00:00:00",
          "ID": "CVE-2017-12636",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache CouchDB",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.2.0 to 1.6.1"
                          },
                          {
                            "version_value": "2.0.0 to 2.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "45019",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/45019/"
            },
            {
              "name": "[dev] 20171114 Apache CouchDB CVE-2017-12635 and CVE-2017-12636",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E"
            },
            {
              "name": "44913",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/44913/"
            },
            {
              "name": "GLSA-201711-16",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201711-16"
            },
            {
              "name": "[debian-lts-announce] 20180121 [SECURITY] [DLA 1252-1] couchdb security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html"
            },
            {
              "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbmu03935en_us",
              "refsource": "CONFIRM",
              "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbmu03935en_us"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2017-12636",
    "datePublished": "2017-11-14T20:00:00Z",
    "dateReserved": "2017-08-07T00:00:00",
    "dateUpdated": "2024-09-16T18:48:31.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.7.0\", \"matchCriteriaId\": \"DCEE0A7F-2D9E-4B71-AB1D-F7E51FAF8839\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:couchdb:2.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7C28D397-7FB6-472F-A602-C2E7E4CCC7D9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:couchdb:2.0.0:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"20694545-A117-4327-9704-E4E9C26C0A10\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:couchdb:2.0.0:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"53337458-D551-42E3-825D-1E94AB8409D3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:couchdb:2.0.0:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"C6848350-0CDC-4CB1-B6DB-1A47227F10AF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:couchdb:2.0.0:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"2A820A52-9170-4E32-B224-1C9E7F48A6D2\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.\"}, {\"lang\": \"es\", \"value\": \"Los usuarios administrativos de CouchDB pueden configurar el servidor de la base de datos mediante HTTP(S). Algunas de las opciones de configuraci\\u00f3n incluyen rutas para operar binarios a nivel de sistema que son iniciados subsecuentemente por CouchDB. Esto permite que un usuario administrador en versiones anteriores a la 1.7.0 y versiones 2.x anteriores a la 2.1.1 de Apache CouchDB ejecuten comandos shell arbitrarios como el usuario CouchDB, incluyendo la descarga y ejecuci\\u00f3n de scripts del internet p\\u00fablico.\"}]",
      "id": "CVE-2017-12636",
      "lastModified": "2024-11-21T03:09:56.593",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:C/I:C/A:C\", \"baseScore\": 9.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 8.0, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2017-11-14T20:29:00.247",
      "references": "[{\"url\": \"https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html\", \"source\": \"security@apache.org\"}, {\"url\": \"https://security.gentoo.org/glsa/201711-16\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbmu03935en_us\", \"source\": \"security@apache.org\"}, {\"url\": \"https://www.exploit-db.com/exploits/44913/\", \"source\": \"security@apache.org\"}, {\"url\": \"https://www.exploit-db.com/exploits/45019/\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/201711-16\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbmu03935en_us\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.exploit-db.com/exploits/44913/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.exploit-db.com/exploits/45019/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@apache.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-78\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-12636\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2017-11-14T20:29:00.247\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.\"},{\"lang\":\"es\",\"value\":\"Los usuarios administrativos de CouchDB pueden configurar el servidor de la base de datos mediante HTTP(S). Algunas de las opciones de configuraci\u00f3n incluyen rutas para operar binarios a nivel de sistema que son iniciados subsecuentemente por CouchDB. Esto permite que un usuario administrador en versiones anteriores a la 1.7.0 y versiones 2.x anteriores a la 2.1.1 de Apache CouchDB ejecuten comandos shell arbitrarios como el usuario CouchDB, incluyendo la descarga y ejecuci\u00f3n de scripts del internet p\u00fablico.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:C/I:C/A:C\",\"baseScore\":9.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.7.0\",\"matchCriteriaId\":\"DCEE0A7F-2D9E-4B71-AB1D-F7E51FAF8839\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:couchdb:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C28D397-7FB6-472F-A602-C2E7E4CCC7D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:couchdb:2.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"20694545-A117-4327-9704-E4E9C26C0A10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:couchdb:2.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"53337458-D551-42E3-825D-1E94AB8409D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:couchdb:2.0.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6848350-0CDC-4CB1-B6DB-1A47227F10AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:couchdb:2.0.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A820A52-9170-4E32-B224-1C9E7F48A6D2\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html\",\"source\":\"security@apache.org\"},{\"url\":\"https://security.gentoo.org/glsa/201711-16\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbmu03935en_us\",\"source\":\"security@apache.org\"},{\"url\":\"https://www.exploit-db.com/exploits/44913/\",\"source\":\"security@apache.org\"},{\"url\":\"https://www.exploit-db.com/exploits/45019/\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/201711-16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbmu03935en_us\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.exploit-db.com/exploits/44913/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.exploit-db.com/exploits/45019/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.