CVE-2018-11769
Quick assessment
Affected
Apache Software Foundation Apache CouchDB
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CouchDB是用Erlang开发的一套面向文档的数据库系统。 CouchDB 2.2.0之前版本中存在安全漏洞，该漏洞源于程序没有充分的验证管理员通过HTTP API提交的配置设置。攻击者可利用该漏洞绕过配置设置的黑名单，提升至操作系统用户权限，进而执行任意代码。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1548 · Abuse Elevation Control Mechanism
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-11769
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
CouchDB 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CouchDB是用Erlang开发的一套面向文档的数据库系统。 CouchDB 2.2.0之前版本中存在安全漏洞，该漏洞源于程序没有充分的验证管理员通过HTTP API提交的配置设置。攻击者可利用该漏洞绕过配置设置的黑名单，提升至操作系统用户权限，进而执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CouchDB | Apache Tomcat 1.x and =2.1.2 | - |
|
II. Public POCs for CVE-2018-11769
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-11769
请登录查看更多情报信息。
Vendor Advisories for CVE-2018-11769 (2)
Mailing List Discussions for CVE-2018-11769 (3)
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5FPHVVU5KMRFKQTJPAM3TBGC7LKCWQS/ vendor-advisory x_refsource_FEDORA
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JOUCX7LHDV4YWZDQNXT5NTKKRANZQW/ vendor-advisory x_refsource_FEDORA
Other References for CVE-2018-11769 (1)
IV. Related Vulnerabilities
Same product: Apache CouchDB
-
CVE-2023-45725
Apache CouchDB, IBM Cloudant: Privilege Escalation Using _de -
CVE-2023-26268
Apache CouchDB, IBM Cloudant: Information sharing via couchj -
CVE-2022-24706
Remote Code Execution Vulnerability in Packaging -
CVE-2021-38295
Privilege escalation vulnerability when using HTML attachmen -
CVE-2020-1955
Apache CouchDB 安全漏洞
Same vendor: Apache Software Foundation
-
CVE-2026-70410
Apache Calcite Avatica: Unrestricted class initialization wh -
CVE-2026-94301
Apache MINA: CVE-2026-47065 resolveProxyClass fix missing fr -
CVE-2026-86473
Apache Airflow: Logout ignores a presented Authorization bea -
CVE-2026-75158
Apache Airflow: Assets events API returns asset events for e -
CVE-2026-82355
Apache Airflow: Session cookie silently overrides explicit A
V. Comments for CVE-2018-11769
No comments yet