CVE-2017-12636

CouchDB administrative users can configure the database server via HTTP(S). Some of the...

7.2 HighPublic exploitFix available

CVE-2017-12636 is a high vulnerability (CVSS 7.2) in Apache Couchdb, published November 14, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 90.6%, the 99th percentile. Fixed in couchdb 1.2.0-5+deb7u1.

CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

90.6%Up 18.4 points since Apr 14, 2021

What each source reports

NVD Score used 7.2

Record: CVE-2017-12636
CVSS 3.0: 7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness: CWE-78
Updated: 2026-11-02

CVE List No score

Record: CVE-2017-12636
Updated: 2026-11-02

EUVDEUVD-2017-4175 No score

Record: EUVD-2017-4175
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fcpq-cj4x-h8mv 7.2

CouchDB administrative users can configure the database server via HTTP(S). Some of the...

Record: GHSA-fcpq-cj4x-h8mv
CVSS 3.0: 7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

OSV 7.2

Record: CVE-2017-12636
CVSS 3.0: 7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-12636 7.2

Record: UBUNTU-CVE-2017-12636
CVSS 3.0: 7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVSUSE-SU-2018:2578-1 No score

Security update for couchdb

This update for couchdb to 1.7.2 fixes the following security issues:

CVE-2018-8007: Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it was possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API (bsc#1100973).
CVE-2017-12636: CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allowed an admin user in Apache CouchDB to execute arbitrary shell commands as the CouchDB user (bsc#1068386).

Record: SUSE-SU-2018:2578-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`couchdb` Debian:7	before 1.2.0-5+deb7u1, plus listed versions 1.2.0-5	1.2.0-5+deb7u1
`couchdb` SUSE:OpenStack Cloud 7	before 1.7.2-2.8.2	1.7.2-2.8.2
`couchdb` SUSE:Enterprise Storage 4	before 1.7.2-2.8.2	1.7.2-2.8.2
`couchdb` Ubuntu:16.04:LTS	All versions, plus listed versions 1.6.0-0ubuntu7	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Apache CouchDB < 2.1.0 - Remote Code Execution	2018-06-20
Exploit-DB	Apache CouchDB - Arbitrary Command Execution (Metasploit)	2018-07-13
Metasploit	Apache CouchDB Arbitrary Command Execution	2016-04-06
PoC in GitHub	XTeam-Wing/CVE-2017-12636	2020-03-23
PoC in GitHub	moayadalmalat/CVE-2017-12636	2018-08-25

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

References

Show 11 moreShow less