CVE-2023-45725: Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document…

PriorityP431medium5.7CVSS 3.1

AVNACLPRLUIRSUCHINAN

EPSS

1.23%

65.6th percentile

Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.

These design document functions are:
* list
* show
* rewrite
* update

An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an "update" function.

For the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document.

Workaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	couchdb	<= 3.3.2	—
apache_software_foundation	apache_couchdb	<= 3.3.2	—
apache_software_foundation	ibm_cloudant	< 8413	8413

CVSS provenance

nvdv3.15.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

osv5.7MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.