CVE catalog
CVE-2018-8007
UBUNTU-CVE-2018-8007
- Severity
- High · CVSS 8.8
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 12.16% · Oct 25, 2026
This update for couchdb fixes the following security issues: - CVE-2018-8007: Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it was possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API (bsc#1100973)
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Suse | couchdb | openstack cloud crowbar 8 | 1.7.2-3.3.1 | fixed |
| Ubuntu | couchdb | 16.04 | 1.6.0-0ubuntu7 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Suse | couchdb | rpm | openstack cloud crowbar 8 | 1.7.2-3.3.1 | Not reported | SUSE-SU-2018:2765-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: