CVE-2017-12636
CouchDB administrative users can configure the database server via HTTP(S). Some of the...
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
- Record
CVE-2017-12636- CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
- Record
CVE-2017-12636- Updated
- 2026-11-02
EUVDEUVD-2017-4175 No score
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
- Record
EUVD-2017-4175- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fcpq-cj4x-h8mv
CouchDB administrative users can configure the database server via HTTP(S). Some of the...
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
- Record
GHSA-fcpq-cj4x-h8mv- CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
- Record
CVE-2017-12636- CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-12636
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
- Record
UBUNTU-CVE-2017-12636- CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2018:2578-1 No score
Security update for couchdb
This update for couchdb to 1.7.2 fixes the following security issues:
- CVE-2018-8007: Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it was possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API (bsc#1100973).
- CVE-2017-12636: CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allowed an admin user in Apache CouchDB to execute arbitrary shell commands as the CouchDB user (bsc#1068386).
- Record
SUSE-SU-2018:2578-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
couchdbDebian:7 From an advisory covering 2 CVEs |
before 1.2.0-5+deb7u1, plus listed versions 1.2.0-5 |
1.2.0-5+deb7u1 |
couchdbSUSE:OpenStack Cloud 7 From an advisory covering 2 CVEs |
before 1.7.2-2.8.2 | 1.7.2-2.8.2 |
couchdbSUSE:Enterprise Storage 4 From an advisory covering 2 CVEs |
before 1.7.2-2.8.2 | 1.7.2-2.8.2 |
couchdbUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.0-0ubuntu7 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Apache CouchDB Arbitrary Command Execution | 2016-04-06 |
| Exploit-DB | Apache CouchDB < 2.1.0 - Remote Code Execution | 2018-06-20 |
| Exploit-DB | Apache CouchDB - Arbitrary Command Execution (Metasploit) | 2018-07-13 |
| PoC in GitHub | moayadalmalat/CVE-2017-12636 | 2018-08-25 |
| PoC in GitHub | XTeam-Wing/CVE-2017-12636 | 2020-03-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-12636 is a high vulnerability (CVSS 7.2) in Apache Couchdb, published November 14, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 90.6%, the 99th percentile. No source names a fixed version.
References
exploit-db.com/exploits/45019
lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E
security.gentoo.org/glsa/201711-16
lists.debian.org/debian-lts-announce/2018/01/msg00026.html
support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-12636
github.com/advisories/GHSA-fcpq-cj4x-h8mv
suse.com/support/update/announcement/2018/suse-su-20182578-1
bugzilla.suse.com/1068386
ubuntu.com/security/CVE-2017-12636
openwall.com/lists/oss-security/2017/11/14/6
cve.org/CVERecord?id=CVE-2017-12636