CVE-2023-26268: apache software foundation apache couchdb
Vulnerability summary
CVE-2023-26268 is a medium (CVSS 5.3) vulnerability in apache software foundation apache couchdb. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.5% of scored vulnerabilities.
Timeline
- 02-05-2023PublishedVulnerability first disclosed.
- 15-10-2024Last modifiedVulnerability information updated.
Description
Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: * validate_doc_update * list * filter * filter views (using view functions as filters) * rewrite * update This doesn't affect map/reduce or search (Dreyfus) index functions. Users are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3). Workaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA4.4MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
1.43%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.43% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache software foundation2 products
- apache couchdb≤ 3.3.1
- ibm cloudant≤ 8349
Apache1 product
- couchdb< 3.2.3 | ≥ 3.3.0, < 3.3.2
Ibm1 product
- cloudant≤ 8349
Ubuntu1 product
- couchdbAll versions (No fix recorded)
4 vendors · 5 products