CVE-2021-38295

{"containers": {"cna": {"affected": [{"product": "Apache CouchDB", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.1.2", "status": "affected", "version": "Apache CouchDB", "versionType": "custom"}]}, {"product": "IBM Cloudant", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "8201", "status": "affected", "version": "IBM Cloudant", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "This issue was identified by Cory Sabol of Secure Ideas."}], "descriptions": [{"lang": "en", "value": "In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2"}], "metrics": [{"other": {"content": {"other": "low"}, "type": "unknown"}}], "problemTypes": [{"descriptions": [{"description": "Privilege escalation", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-10-14T19:55:12.000Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://docs.couchdb.org/en/stable/cve/2021-38295.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Privilege escalation vulnerability when using HTML attachments", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2021-38295", "STATE": "PUBLIC", "TITLE": "Privilege escalation vulnerability when using HTML attachments"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache CouchDB", "version": {"version_data": [{"version_affected": "<", "version_name": "Apache CouchDB", "version_value": "3.1.2"}]}}]}, "vendor_name": "Apache Software Foundation"}, {"product": {"product_data": [{"product_name": "IBM Cloudant", "version": {"version_data": [{"version_affected": "<", "version_name": "IBM Cloudant", "version_value": "8201"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "credit": [{"lang": "eng", "value": "This issue was identified by Cory Sabol of Secure Ideas."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2"}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": [{"other": "low"}], "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Privilege escalation"}]}]}, "references": {"reference_data": [{"name": "https://docs.couchdb.org/en/stable/cve/2021-38295.html", "refsource": "MISC", "url": "https://docs.couchdb.org/en/stable/cve/2021-38295.html"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:37:16.335Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://docs.couchdb.org/en/stable/cve/2021-38295.html"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2021-38295", "datePublished": "2021-10-14T19:55:12.000Z", "dateReserved": "2021-08-09T00:00:00.000Z", "dateUpdated": "2024-08-04T01:37:16.335Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Apache CouchDB", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.1.2", "status": "affected", "version": "Apache CouchDB", "versionType": "custom"}]}, {"product": "IBM Cloudant", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "8201", "status": "affected", "version": "IBM Cloudant", "versionType": "custom"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*", "matchCriteriaId": "055B353E-396A-4925-96AC-1D2877607139", "versionEndExcluding": "3.1.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2"}, {"lang": "es", "value": "En Apache CouchDB, un usuario malicioso con permiso para crear documentos en una base de datos puede adjuntar un archivo adjunto HTML a un documento. Si un administrador de CouchDB abre ese adjunto en un navegador, por ejemplo, por medio de la interfaz de administraci\u00f3n de CouchDB Fauxton, cualquier c\u00f3digo JavaScript insertado en ese adjunto HTML se ejecutar\u00e1 dentro del contexto de seguridad de ese administrador. Una ruta similar est\u00e1 disponible con la funcionalidad _show y _list, ya obsoleta. Esta vulnerabilidad de escalada de privilegios permite a un atacante a\u00f1adir o eliminar datos en cualquier base de datos o realizar cambios de configuraci\u00f3n. Este problema afectaba a Apache CouchDB versiones anteriores a 3.1.2"}], "id": "CVE-2021-38295", "lastModified": "2026-06-17T04:01:49.133", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-10-14T20:15:09.017", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://docs.couchdb.org/en/stable/cve/2021-38295.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://docs.couchdb.org/en/stable/cve/2021-38295.html"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "couchdb: forget HTML attachment may lead to privileges escalation", "id": "2027192", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2027192"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-345", "details": ["In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2"], "name": "CVE-2021-38295", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "camel-couchdb", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Not affected", "package_name": "camel-couchdb", "product_name": "Red Hat Integration Camel K 1"}, {"cpe": "cpe:/a:redhat:camel_quarkus:2", "fix_state": "Not affected", "package_name": "camel-couchdb", "product_name": "Red Hat Integration Camel Quarkus 1"}, {"cpe": "cpe:/a:redhat:jboss_fuse:6", "fix_state": "Out of support scope", "package_name": "camel-couchdb", "product_name": "Red Hat JBoss Fuse 6"}], "public_date": "2021-10-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-38295\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-38295"], "threat_severity": "Moderate"}

{}