CVE-2023-45725

Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: *   list *   show *   rewrite *   update An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an "update" function. For the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document. Workaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers

• CWE-200

• https://docs.couchdb.org/en/stable/cve/2023-45725.htmlPatch, Vendor Advisory
• https://lists.apache.org/thread/pqjq9zt8vq9rsobkc1cow9sqm9vozlrgMailing List, Vendor Advisory
• https://docs.couchdb.org/en/stable/cve/2023-45725.htmlPatch, Vendor Advisory
• https://lists.apache.org/thread/pqjq9zt8vq9rsobkc1cow9sqm9vozlrgMailing List, Vendor Advisory

Published

Dec 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4572Use after free in MediaStream in Google Chrome prior to 116.…8.8
• CVE-2023-45720Insufficient default configuration in HCL Leap allows anonym…5.3
• CVE-2023-45721Insufficient default configuration in HCL Leap allows anonym…5.3
• CVE-2023-45722HCL DRYiCE MyXalytics is impacted by path traversal arbitrar…9.8
• CVE-2023-45723HCL DRYiCE MyXalytics is impacted by path traversal vulnerab…9.8
• CVE-2023-45724HCL DRYiCE MyXalytics product is impacted by unauthenticated…9.8
• CVE-2023-45727Proself Enterprise/Standard Edition Ver5.62 and earlier, Pro…7.5
• CVE-2023-4573When receiving rendering data over IPC `mStream` could have …6.5
• CVE-2023-45733Hardware logic contains race conditions in some Intel(R) Pro…2.8
• CVE-2023-45734 in OpenHarmony v3.2.4 and prior versions allow an adjacent …8.8
• CVE-2023-45735 A potential attacker with access to the Westermo Lynx d…8
• CVE-2023-45736Insecure inherited permissions in Intel(R) Power Gadget soft…7.8