Known vulnerabilities in CouchDB

Software: CouchDB
Software CPE: cpe:2.3:a:apache_foundation:couchdb:*:*:*:*:*:*:*:*
Total vulnerabilities: 14
Public exploits: 4
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting CouchDB CouchDB is affected by 14 known vulnerabilities: 4 high, 4 medium, 6 low Critical High Medium Low

Vulnerabilities (14)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU84347 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-45725
CWE-94 Medium
No
No
3.3.3 12.12.2023 SB20231212106
SB20240620116
#VU75675 - Improper Access Control
CVE-2023-26268
CWE-284 Medium
No
No
3.2.3, 3.3.2 02.05.2023 SB2023050248
SB2023082101
SB2023082861
and 1 more
#VU62595 - Missing Authentication for Critical Function
CVE-2022-24706
CWE-306 High
Available
Exploited
3.2.2 26.04.2022 SB2022042615
SB2024022927
SB20240620116
#VU57237 - Permissions, Privileges, and Access Controls
CVE-2021-38295
CWE-264 Medium
Available
No
3.1.2 12.10.2021 SB2021101205
SB20240620116
#VU28138 - Improper Access Control
CVE-2020-1955
CWE-284 Low
No
No
3.0.1 20.05.2020 SB2020052029
#VU17770 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
- 19.02.2019 SB2019021913
#VU17274 - Permissions, Privileges, and Access Controls
CVE-2017-12635
CWE-264 Low
Available
No
1.7.0, 2.1.1 30.01.2019 SB2017111434
SB2017111613
SB2017111905
and 2 more
#VU16815 - Permissions, Privileges, and Access Controls
CVE-2018-17188
CWE-264 Low
No
No
2.3.0 07.01.2019 SB2019010701
SB2020030622
SB2020030623
#VU14325 - Improper input validation
CVE-2018-8007
CWE-20 High
No
No
1.7.2, 2.1.2 13.08.2018 SB2018081308
SB2018081309
SB2018121701
and 2 more
#VU14324 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2017-12636
CWE-78 High
Available
No
1.7.0, 2.1.1 13.08.2018 SB2018081308
SB2018081309
SB2017111613
and 3 more
#VU14323 - Improper input validation
CVE-2018-11769
CWE-20 High
No
No
2.2.0 11.08.2018 SB2018081308
SB2018081309
SB2018121701
and 2 more
#VU41631 - Improper Control of Generation of Code ('Code Injection')
CVE-2012-5649
CWE-94 Medium
No
No
- 23.05.2014 SB2014031805
SB2013012308
SB2013012309
#VU41907 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-5650
CWE-79 Low
No
No
- 18.03.2014 SB2014031805
SB2013012308
SB2013012309
#VU45397 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2010-3854
CWE-79 Low
No
No
- 02.02.2011 SB2011020205
SB2011021301
SB2011051901
and 1 more