{"answers":{"affected":"1 open source package ship an affected version, including couchdb. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-45725 in the wild and no public exploit code.","fix":"Upgrade couchdb to 3.3.3 or later.","what":"CVE-2023-45725 is a medium-severity vulnerability in Apache CouchDB, published on 13 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2023-45725 and fix it if it is affected.\n\nWhat it is: CVE-2023-45725 is a medium-severity vulnerability in Apache CouchDB, published on 13 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2023-45725 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- couchdb (Bitnami): affected all versions; fixed in 3.3.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-45725/ (Markdown: https://insights.sbomify.com/CVE-2023-45725/index.md)","id":"CVE-2023-45725","markdown":"https://insights.sbomify.com/CVE-2023-45725/index.md","name":"CVE-2023-45725","record":{"aliases":["BIT-couchdb-2023-45725","GHSA-rmfx-8gmj-c39q","UBUNTU-CVE-2023-45725"],"analysis":{"component_type":"database","fix_type":"upgrade","impacts":["data_read","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"CouchDB database","requires_auth":"low_privilege","summary":"Attackers can steal session cookies from design document functions, potentially leading to account takeover if they can insert malicious documents.","user_interaction":"required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"couchdb","vendor":"apache"}],"cvss":{"score":5.7,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.\n\nThese design document functions are:\n  *    list\n  *    show\n  *    rewrite\n  *    update\n\nAn attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an \"update\" function.\n\nFor the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document.\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers","ecosystems":["Bitnami"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents","id":"CVE-2023-45725","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":"information_disclosure","year":"2023"},"n_packages":1,"n_references":2,"next":{"headline":"North Grid Proself Improper Restriction of XML External Entity (XXE) Reference","id":"CVE-2023-45727"},"packages":[{"ecosystem":"Bitnami","fixed":["3.3.3"],"introduced":["0"],"last_affected":[],"package":"couchdb","purl":"pkg:bitnami/couchdb","source":"BIT-couchdb-2023-45725"}],"prev":{"headline":"Unauthenticated File Upload affects DRYiCE MyXalytics","id":"CVE-2023-45724"},"products":["Apache CouchDB","IBM Cloudant"],"published":"2023-12-13","related":[{"cvss_score":9.8,"headline":"Apache CouchDB Insecure Default Initialization of Resource","id":"CVE-2022-24706","kev_date_added":"2022-08-25","published":"2022-04-26"},{"cvss_score":9.8,"headline":"Auth bypass in Apache CouchDB","id":"CVE-2020-1955","kev_date_added":null,"published":"2020-05-20"},{"cvss_score":9.8,"headline":"Privilege escalation in Apache CouchDB","id":"CVE-2017-12635","kev_date_added":null,"published":"2017-11-14"},{"cvss_score":7.8,"headline":"Code injection in n/a","id":"CVE-2018-14889","kev_date_added":null,"published":"2018-09-21"},{"cvss_score":7.8,"headline":"Privilege escalation in Apache CouchDB","id":"CVE-2016-8742","kev_date_added":null,"published":"2018-02-12"},{"cvss_score":7.3,"headline":"Privilege escalation vulnerability when using HTML attachments","id":"CVE-2021-38295","kev_date_added":null,"published":"2021-10-14"},{"cvss_score":7.2,"headline":"Code injection in Apache CouchDB","id":"CVE-2018-17188","kev_date_added":null,"published":"2019-01-02"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-02","vendors":["Apache Software Foundation"]},"summary":"Attackers can steal session cookies from design document functions, potentially leading to account takeover if they can insert malicious documents.","url":"https://insights.sbomify.com/CVE-2023-45725/"}