CVE-2023-45725

Katalog CVE

CVSS 5.7 · Medium EPSS 1,2%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada apache couchdb. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: *   list *   show *   rewrite *   update An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an "update" function. For the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document. Workaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers

Rincian

Terbit di NVD

13 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.7 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.couchdb.org/en/stable/cve/2023-45725.html patch · advisory vendor
• https://lists.apache.org/thread/pqjq9zt8vq9rsobkc1cow9sqm9vozlrg mailing list · advisory vendor