Is CVE-2018-11769 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 8%.

What products does CVE-2018-11769 affect?

Tracked products affected include CouchDB. Check the version you run to see whether it is affected.

How do I fix CVE-2018-11769?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2018-11769

Q: What is CVE-2018-11769?

CVE-2018-11769 is a high-severity software vulnerability with a CVSS score of 7.2. CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to es

HIGH severity · CVSS 7.2

7.2CVSS HIGH

Summary

CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredHigh

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)8%

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

CouchDB

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

CVE-2018-11769

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information