CVE-2018-8007 in the critical feed json
Apache CouchDB administrative users can configure the database server via HTTP(S).
published 2018-07-11 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-19718
- cvss
- 7.2
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 12.2%
- EPSS 12.2% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows an existing CouchDB admin user to gain arbitrary remote code execution, bypassing already disclosed CVE-2017-12636. Mitigation: All users should upgrade to CouchDB releases 1.7.2 or 2.1.2.
Patch / fix
- couchdb OpenStack Cloud Crowbar 8 1.7.2-3.3.1
- couchdb OpenStack Cloud 7, Enterprise Storage 4 1.7.2-2.8.2
suse advisories SUSE-SU-2018:2765-1SUSE-SU-2018:2578-1
- couchdb Arch Linux 2.1.2-1
arch linux advisories AVG-759
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2018-8007 updated cvss 8.0
couchdb: Administrative Privilege Escalation
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
12.16% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- mdsec.co.uk https://www.mdsec.co.uk/2018/08/advisory-cve-2018-8007-apache-couchdb-remote-code-execution/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Affected products
- Apache Software Foundation Apache CouchDB
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
mdsec.co.uk
/2018/08/advisory-cve-2018-8007-apache-couchdb-remote-code-execution/
exploit, third-party-advisory
-
security.gentoo.org
/glsa/201812-06
vendor-advisory, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/X3JOUCX7LHDV4YWZDQNXT5NTKKRANZQW/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/S5FPHVVU5KMRFKQTJPAM3TBGC7LKCWQS/
vendor-advisory
-
mail-archives.apache.org
/mod_mbox/couchdb-announce/201807.mbox/%3c1439409216.6221.1531246856676.JavaMail.Joan%40RITA%3e
mailing-list
-
mail-archives.apache.org
/mod_mbox/couchdb-announce/201807.mbox/%3C1699016538.6219.1531246785603.JavaMail.Joan%40RITA%3E
mailing-list, third-party-advisory
-
securityfocus.com
/bid/104741
vdb-entry, third-party-advisory
-
blog.couchdb.org
/2018/07/10/cve-2018-8007/
third-party-advisory
- support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us
Sources
- CVE List CVE-2018-8007
- NVD CVE-2018-8007
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.