CVE-2020-1955 — Missing Authentication for Critical Function in Software Foundation Apache Couchdb

CWE-306 — Missing Authentication for Critical Function CWE-269 — Improper Privilege Management CWE-22 — Path Traversal CWE-79 — Cross-site Scripting7 documents5 sources

Severity

9.8CRITICALNVD

EPSS

1.9%

top 16.88%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Software Foundation Apache Couchdb Apache Couchdb

Timeline

PublishedMay 20

Latest updateJun 24

Description

CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_up`. It was meant as an extension to the long standing setting `require_valid_user`, which in turn requires that any and all requests to CouchDB will have to be made with valid credentials, effectively forbidding any anonymous requests. The new `require_valid_user_except_for_up` is an off-by-default setting that was meant to allow requirin…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDapache/couchdb3.0.0

▶CVEListV5apache_software_foundation/apache_couchdbApache CouchDB 3.0.0

🔴Vulnerability Details

GHSA

Cross-site Scripting vulnerability in Jenkins↗2022-06-24

▶

GHSA

GHSA-6625-2573-pv96: CouchDB version 3↗2022-05-24

▶

CVEList

CVE-2020-1955: CouchDB version 3↗2020-05-20

▶

💬Community

Bugzilla

CVE-2020-2229 jenkins: user-specified tooltip values leads to stored cross-site scripting↗2020-09-02

▶

Bugzilla

CVE-2020-1955 couchdb: remote privilege escalation when require_valid_user_except_for_up setting is enable [fedora-all]↗2020-05-26

▶

Bugzilla

CVE-2020-1955 couchdb: remote privilege escalation when require_valid_user_except_for_up setting is enable↗2020-05-26

▶