CVE-2018-17188
Quick assessment
Affected
Apache Software Foundation Apache CouchDB
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache CouchDB是美国阿帕奇（Apache）软件基金会的使用Erlang开发的一套面向文档的数据库系统。 Apache CouchDB 2.3.0之前版本中存在权限许可和访问控制问题漏洞，该漏洞源于网络系统或产品缺乏有效的权限许可和访问控制措施。
Possible ATT&CK Techniques 1 AI
T1548 · Abuse Elevation Control Mechanism
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-17188
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full system entry for unauthenticated users. Rather than waiting for new vulnerabilities to be discovered, and fixing them as they come up, the CouchDB development team decided to make changes to avoid this entire class of vulnerabilities.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Apache CouchDB 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache CouchDB是美国阿帕奇（Apache）软件基金会的使用Erlang开发的一套面向文档的数据库系统。 Apache CouchDB 2.3.0之前版本中存在权限许可和访问控制问题漏洞，该漏洞源于网络系统或产品缺乏有效的权限许可和访问控制措施。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CouchDB | All | - |
|
II. Public POCs for CVE-2018-17188
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-17188
请登录查看更多情报信息。
Mailing List Discussions for CVE-2018-17188 (2)
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5FPHVVU5KMRFKQTJPAM3TBGC7LKCWQS/ vendor-advisory x_refsource_FEDORA
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JOUCX7LHDV4YWZDQNXT5NTKKRANZQW/ vendor-advisory x_refsource_FEDORA
Security Blog Posts for CVE-2018-17188 (1)
-
https://blog.couchdb.org/2018/12/17/cve-2018-17188/ x_refsource_MISC
Other References for CVE-2018-17188 (1)
IV. Related Vulnerabilities
Same product: Apache CouchDB
-
CVE-2023-45725
Apache CouchDB, IBM Cloudant: Privilege Escalation Using _de -
CVE-2023-26268
Apache CouchDB, IBM Cloudant: Information sharing via couchj -
CVE-2022-24706
Remote Code Execution Vulnerability in Packaging -
CVE-2021-38295
Privilege escalation vulnerability when using HTML attachmen -
CVE-2020-1955
Apache CouchDB 安全漏洞
Same vendor: Apache Software Foundation
-
CVE-2026-107460
Apache Fesod (Incubating): UrlImageConverter SSRF protection -
CVE-2026-92120
Apache Allura: Oauth1 Replay Attack -
CVE-2026-92119
Apache Allura: REST API Mass Assignment -
CVE-2026-92116
Apache Allura: OAuth1 missing callback validation -
CVE-2026-85499
Apache SkyWalking BanyanDB: Canopy does not enforce readonly
V. Comments for CVE-2018-17188
No comments yet