CVE-2021-38295
Privilege escalation vulnerability when using HTML attachments
HIGH 7.3EPSS 2.7%
In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2
- Affected
- Apache Software Foundation · Apache CouchDB · IBM Cloudant
- CVSS v3.1 NVD
- 7.3 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 6.0 MEDIUM
AV:N/AC:M/Au:S/C:P/I:P/A:P - EPSS
- 2.75% chance of exploitation in the next 30 days, 86th percentile
- Published
- 2021-10-14
- Updated
- 2024-08-04
Proof-of-concept exploits (1)
- ProfessionallyEvil/CVE-2021-38295-PoC3★ · 2021-10-14