CVE-2021-38295

In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2

CVSS v3 7.3 HIGH
CVSS v2.0 6.0 MEDIUM

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://docs.couchdb.org/en/stable/cve/2021-38295.html	Vendor Advisory
https://docs.couchdb.org/en/stable/cve/2021-38295.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-10-14 20:15

Updated : 2024-11-21 06:16

NVD link : CVE-2021-38295

Mitre link : CVE-2021-38295

CVE.ORG link : CVE-2021-38295

JSON object : View

Products Affected

apache

couchdb

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-38295", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "published": "2021-10-14T20:15:09.017", "references": [{"url": "https://docs.couchdb.org/en/stable/cve/2021-38295.html", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://docs.couchdb.org/en/stable/cve/2021-38295.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2"}, {"lang": "es", "value": "En Apache CouchDB, un usuario malicioso con permiso para crear documentos en una base de datos puede adjuntar un archivo adjunto HTML a un documento. Si un administrador de CouchDB abre ese adjunto en un navegador, por ejemplo, por medio de la interfaz de administraci\u00f3n de CouchDB Fauxton, cualquier c\u00f3digo JavaScript insertado en ese adjunto HTML se ejecutar\u00e1 dentro del contexto de seguridad de ese administrador. Una ruta similar est\u00e1 disponible con la funcionalidad _show y _list, ya obsoleta. Esta vulnerabilidad de escalada de privilegios permite a un atacante a\u00f1adir o eliminar datos en cualquier base de datos o realizar cambios de configuraci\u00f3n. Este problema afectaba a Apache CouchDB versiones anteriores a 3.1.2"}], "lastModified": "2024-11-21T06:16:44.313", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "055B353E-396A-4925-96AC-1D2877607139", "versionEndExcluding": "3.1.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}