CVE-2023-26268CWE-200

Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes

Medium · published May 2, 2023

CVSS v3.1
4.4
EPSS
1%
Percentile
72.8
In the wild
Unconfirmed
What it is

Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:

* validate_doc_update

* list

* filter

* filter views (using view functions as filters)

* rewrite

* update

This doesn't affect map/reduce or search (Dreyfus) index functions.

Users are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3).

Workaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01429 · 72.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-05-02T20:06Z
EPSS history
Timeline
  • 02 MAY 20:06Z
    Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes
    cvelistv5