CVE-2021-38295

描述

In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2

如何修補 CVE-2021-38295

要修補 CVE-2021-38295,請將受影響套件升級到下列已修補版本。

• —升級至 3.1.2 或更新版本

CVE-2021-38295 正在被利用嗎?

低 — EPSS 為 2.5%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 3.1.2

CVSS 分數

參考連結(2)

• WEBdocs.couchdb.org/en/stable/cve/2021-38295.html
• WEBnvd.nist.gov/vuln/detail/CVE-2021-38295