{"id":"CVE-2023-45725","aliases":["BIT-couchdb-2023-45725","EUVD-2023-50014","GHSA-rmfx-8gmj-c39q","UBUNTU-CVE-2023-45725"],"status":"published","title":"Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents","description":"Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.\n\nThese design document functions are:\n  *    list\n  *    show\n  *    rewrite\n  *    update\n\nAn attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an \"update\" function.\n\nFor the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document.\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01232,"percentile":0.69342,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2023-12-13T08:02:17Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"Bitnami","package":"couchdb","fixed_in":["3.3.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"couchdb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"couchdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-0ubuntu7"]}],"products":[{"vendor":"apache","product":"couchdb"},{"vendor":"apache software foundation","product":"apache couchdb"},{"vendor":"apache software foundation","product":"ibm cloudant"}],"references":[{"url":"https://lists.apache.org/thread/pqjq9zt8vq9rsobkc1cow9sqm9vozlrg","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","report"]},{"url":"https://docs.couchdb.org/en/stable/cve/2023-45725.html","tags":["release-notes","x_transferred","Patch","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45725","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-rmfx-8gmj-c39q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45725.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-45725","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45725","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-45725","title":"Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents","description":"Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.\n\nThese design document functions are:\n  *    list\n  *    show\n  *    rewrite\n  *    update\n\nAn attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an \"update\" function.\n\nFor the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document.\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers\n","status":"published","published":"2023-12-13T08:02:17.326Z","modified":"2024-08-02T20:29:31.714Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:35:22.640346Z"}],"euvd":[{"id":"EUVD-2023-50014","description":"Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.\n\nThese design document functions are:\n  *    list\n  *    show\n  *    rewrite\n  *    update\n\nAn attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an \"update\" function.\n\nFor the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document.\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers\n","status":"published","published":"2023-12-13T08:02:17Z","modified":"2024-08-02T20:29:31Z","updated_at":"2026-11-03T03:49:58.963788Z"}],"ghsa":[{"id":"GHSA-rmfx-8gmj-c39q","title":"Design document functions which receive a user http request object may expose authorization or...","description":"Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.\n\nThese design document functions are:\n  *    list\n  *    show\n  *    rewrite\n  *    update\n\nAn attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an \"update\" function.\n\nFor the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document.\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers\n","status":"published","published":"2023-12-13T09:30:32Z","modified":"2023-12-29T05:05:29Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:55:17.557989Z"}],"nvd":[{"id":"CVE-2023-45725","description":"Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.\n\nThese design document functions are:\n  *    list\n  *    show\n  *    rewrite\n  *    update\n\nAn attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an \"update\" function.\n\nFor the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document.\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers\n","status":"published","published":"2023-12-13T08:15:50.19Z","modified":"2026-06-17T06:29:25.087Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:08:54.696438Z"}],"osv":[{"id":"UBUNTU-CVE-2023-45725","description":"Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are:   *    list   *    show   *    rewrite   *    update An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an \"update\" function. For the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document. Workaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers","status":"published","published":"2023-12-13T08:15:00Z","modified":"2025-10-24T05:02:17Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"BIT-couchdb-2023-45725","title":"Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents","description":"Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.\n\nThese design document functions are:\n  *    list\n  *    show\n  *    rewrite\n  *    update\n\nAn attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an \"update\" function.\n\nFor the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document.\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers","status":"published","published":"2024-03-06T10:51:03.389Z","modified":"2026-09-08T08:46:04.225182249Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"CVE-2023-45725","title":"Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents","description":"Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.\n\nThese design document functions are:\n  *    list\n  *    show\n  *    rewrite\n  *    update\n\nAn attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an \"update\" function.\n\nFor the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document.\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers\n","status":"published","published":"2023-12-13T08:02:17.326Z","modified":"2026-10-28T02:31:04.472837151Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:34.287121Z"}]}}