CVE-2018-17188

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full system entry for unauthenticated users. Rather than waiting for new vulnerabilities to be discovered, and fixing them as they come up, the CouchDB development team decided to make changes to avoid this entire class of vulnerabilities.

• https://blog.couchdb.org/2018/12/17/cve-2018-17188/Mitigation, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5FPHVVU5KMRFKQTJPAM3TBGC7LKCWQS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JOUCX7LHDV4YWZDQNXT5NTKKRANZQW/
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us
• https://blog.couchdb.org/2018/12/17/cve-2018-17188/Mitigation, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5FPHVVU5KMRFKQTJPAM3TBGC7LKCWQS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JOUCX7LHDV4YWZDQNXT5NTKKRANZQW/
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us

Published

Jan 2, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17182An issue was discovered in the Linux kernel through 4.18.8. …7.8
• CVE-2018-17183Artifex Ghostscript before 9.25 allowed a user-writable erro…
• CVE-2018-17184A malicious user with enough administration entitlements can…
• CVE-2018-17185Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-17186An administrator with workflow definition entitlements can u…
• CVE-2018-17187The Apache Qpid Proton-J transport includes an optional wrap…
• CVE-2018-17189In Apache HTTP server versions 2.4.37 and prior, by sending …5.3
• CVE-2018-1719IBM WebSphere Application Server 8.5 and 9.0 could provide w…5.9
• CVE-2018-17190In all versions of Apache Spark, its standalone resource man…
• CVE-2018-17191Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configu…
• CVE-2018-17192The X-Frame-Options headers were applied inconsistently on s…
• CVE-2018-17193The message-page.jsp error page used the value of the HTTP r…