CVE-2018-8007

Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows an existing CouchDB admin user to gain arbitrary remote code execution, bypassing already disclosed CVE-2017-12636. Mitigation: All users should upgrade to CouchDB releases 1.7.2 or 2.1.2.

• CWE-20

• http://mail-archives.apache.org/mod_mbox/couchdb-announce/201807.mbox/%3C1699016538.6219.1531246785603.JavaMail.Joan%40RITA%3EMailing List, Third Party Advisory
• http://mail-archives.apache.org/mod_mbox/couchdb-announce/201807.mbox/%3c1439409216.6221.1531246856676.JavaMail.Joan%40RITA%3e
• http://www.securityfocus.com/bid/104741Third Party Advisory, VDB Entry
• https://blog.couchdb.org/2018/07/10/cve-2018-8007/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5FPHVVU5KMRFKQTJPAM3TBGC7LKCWQS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JOUCX7LHDV4YWZDQNXT5NTKKRANZQW/
• https://security.gentoo.org/glsa/201812-06Third Party Advisory
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us
• https://www.mdsec.co.uk/2018/08/advisory-cve-2018-8007-apache-couchdb-remote-code-execution/Exploit, Third Party Advisory
• http://mail-archives.apache.org/mod_mbox/couchdb-announce/201807.mbox/%3C1699016538.6219.1531246785603.JavaMail.Joan%40RITA%3EMailing List, Third Party Advisory
• http://mail-archives.apache.org/mod_mbox/couchdb-announce/201807.mbox/%3c1439409216.6221.1531246856676.JavaMail.Joan%40RITA%3e
• http://www.securityfocus.com/bid/104741Third Party Advisory, VDB Entry
• https://blog.couchdb.org/2018/07/10/cve-2018-8007/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5FPHVVU5KMRFKQTJPAM3TBGC7LKCWQS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JOUCX7LHDV4YWZDQNXT5NTKKRANZQW/
• https://security.gentoo.org/glsa/201812-06Third Party Advisory
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us
• https://www.mdsec.co.uk/2018/08/advisory-cve-2018-8007-apache-couchdb-remote-code-execution/Exploit, Third Party Advisory

Published

Jul 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-8001In PoDoFo 0.9.5, there exists a heap-based buffer over-read …
• CVE-2018-8002In PoDoFo 0.9.5, there exists an infinite loop vulnerability…
• CVE-2018-8003Apache Ambari, versions 1.4.0 to 2.6.1, is susceptible to a …
• CVE-2018-8004There are multiple HTTP smuggling and cache poisoning issues…
• CVE-2018-8005When there are multiple ranges in a range request, Apache Tr…
• CVE-2018-8006An instance of a cross-site scripting vulnerability was iden…6.1
• CVE-2018-8008Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, a…
• CVE-2018-8009Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2…
• CVE-2018-8010This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7…
• CVE-2018-8011By specially crafting HTTP requests, the mod_md challenge ha…
• CVE-2018-8012No authentication/authorization is enforced when a server at…7.5
• CVE-2018-8013In Apache Batik 1.x before 1.10, when deserializing subclass…