{"id":"CVE-2021-38295","aliases":["BIT-couchdb-2021-38295","EUVD-2021-24752","GHSA-gr7p-9mx8-wr74","MGASA-2021-0520","UBUNTU-CVE-2021-38295"],"status":"published","title":"Privilege escalation vulnerability when using HTML attachments","description":"In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.03731,"percentile":0.89966,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-269","CWE-79"],"published":"2021-10-14T19:55:12Z","modified":"2026-10-24T10:30:35Z","exploits":[{"source":"pocgithub","id":"ProfessionallyEvil/CVE-2021-38295-PoC","title":"ProfessionallyEvil/CVE-2021-38295-PoC","date":"2021-10-14","url":"https://github.com/ProfessionallyEvil/CVE-2021-38295-PoC"}],"fixes":[{"ecosystem":"Bitnami","package":"couchdb","fixed_in":["3.1.2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"couchdb","fixed_in":["3.1.2-1.mga8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"couchdb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.2"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"couchdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"couchdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-0ubuntu7"]}],"products":[{"vendor":"apache","product":"couchdb"},{"vendor":"apache software foundation","product":"apache couchdb"},{"vendor":"apache software foundation","product":"ibm cloudant"}],"references":[{"url":"https://docs.couchdb.org/en/stable/cve/2021-38295.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38295","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gr7p-9mx8-wr74"},{"url":"https://advisories.mageia.org/MGASA-2021-0520.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29548","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/10/12/2","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-38295","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38295","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-38295","title":"Privilege escalation vulnerability when using HTML attachments","description":"In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2","status":"published","published":"2021-10-14T19:55:12Z","modified":"2024-08-04T01:37:16.335Z","updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-24752","description":"In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2","status":"published","published":"2021-10-14T19:55:12Z","modified":"2024-08-04T01:37:16Z","updated_at":"2026-11-03T03:24:25.244479Z"}],"ghsa":[{"id":"GHSA-gr7p-9mx8-wr74","title":"In Apache CouchDB, a malicious user with permission to create documents in a database is able to...","description":"In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2","status":"published","published":"2022-05-24T19:17:34Z","modified":"2023-08-08T15:31:23Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:54:44.111289Z"}],"nvd":[{"id":"CVE-2021-38295","description":"In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2","status":"published","published":"2021-10-14T20:15:09.017Z","modified":"2026-06-17T04:01:49.133Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:59.689345Z"}],"osv":[{"id":"CVE-2021-38295","description":"In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2","status":"published","published":"2021-10-14T20:15:09.017Z","modified":"2026-10-24T10:30:35.454355766Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"UBUNTU-CVE-2021-38295","description":"In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2","status":"published","published":"2021-10-14T20:15:00Z","modified":"2025-10-24T04:50:28Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"BIT-couchdb-2021-38295","title":"Privilege escalation vulnerability when using HTML attachments","description":"In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2","status":"published","published":"2024-03-06T10:51:34.463Z","modified":"2026-09-08T08:46:01.199914109Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"MGASA-2021-0520","title":"Updated couchdb packages fix security vulnerability","description":"Privilege escalation that allows an attacker to add or remove data in any\ndatabase or make configuration changes. (CVE-2021-38295)\n","status":"published","published":"2021-11-25T13:06:13Z","modified":"2026-04-16T04:42:03.598862953Z","updated_at":"2026-11-02T15:49:41.849028Z"}]}}