CVE-2021-38295: apache software foundation apache couchdb Cross-site Scripting
Vulnerability summary
CVE-2021-38295 is a high (CVSS 7.3) Cross-site Scripting vulnerability in apache software foundation apache couchdb. EPSS estimates a 2.75% chance of exploitation in the next 30 days, higher than 85.9% of scored vulnerabilities.
Timeline
- 14-10-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.75%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
+0.24 pp
From 2.51% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache software foundation2 products
- apache couchdb≥ Apache CouchDB, < 3.1.2
- ibm cloudant≥ IBM Cloudant, < 8201
Apache1 product
- couchdb< 3.1.2
Mageia1 product
- couchdb< 3.1.2-1.mga8
Ubuntu1 product
- couchdbAll versions (No fix recorded)
4 vendors · 5 products