ID:6890 - Exploit for Security restrictions bypass in CouchDB - CVE-2021-38295

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to application does not properly impose security restrictions and allows a remote authenticated users with permission to create documents in a database to attach a HTML attachment to a document. If a CouchDB administrator opens such attachment the HTML code will be executed in the administrator's browser.

Remediation