CVE-2023-26268: Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document…

PriorityP428medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

1.43%

69.9th percentile

Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:
* validate_doc_update

* list

* filter

* filter views (using view functions as filters)

* rewrite

* update


This doesn't affect map/reduce or search (Dreyfus) index functions.

Users are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3).

Workaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
apache	couchdb	< 3.2.3	3.2.3
apache	couchdb	>= 3.3.0 < 3.3.2	3.3.2
apache_software_foundation	apache_couchdb	<= 3.3.1	—
apache_software_foundation	ibm_cloudant	<= 8349	—
ibm	cloudant	<= 8349	—

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

osv5.3MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.