Is CVE-2018-17188 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 4%.

What products does CVE-2018-17188 affect?

Tracked products affected include CouchDB. Check the version you run to see whether it is affected.

How do I fix CVE-2018-17188?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2018-17188

Q: What is CVE-2018-17188?

CVE-2018-17188 is a high-severity software vulnerability with a CVSS score of 7.2. Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB u

HIGH severity · CVSS 7.2

7.2CVSS HIGH

Summary

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full system entry for unauthenticated users. Rather than waiting for new vulnerabilities to be discovered, and fixing them as they come up, the CouchDB development team decided to make changes to avoid this entire class of vulnerabilities.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredHigh

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)4%

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

CouchDB

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

CVE-2018-17188

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information