Improper access control in CouchDB - CVE-2023-26268
Published: May 2, 2023
Vulnerability identifier: #VU75675
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-26268
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in the couchjs processes. Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:
- validate_doc_update
- list
- filter
- filter views (using view functions as filters)
- rewrite
- update
Affected software
CouchDB
IBM Cloud Pak for Multicloud Management
App Connect Enterprise Certified Container
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Cloud Pak for Multicloud Management
App Connect Enterprise Certified Container
Automation Assets in IBM Cloud Pak for Integration (CP4I)
How to mitigate CVE-2023-26268
Install updates from vendor's website.
CouchDB - addressed in versions 3.2.3, 3.3.2
IBM Cloud Pak for Multicloud Management - update to 2.3.8
App Connect Enterprise Certified Container - addressed in versions 5.0.10, 9.1.0
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-11
IBM Cloud Pak for Multicloud Management - update to 2.3.8
App Connect Enterprise Certified Container - addressed in versions 5.0.10, 9.1.0
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-11