UpHeron
All vulnerabilities

Servers and applications

CVE-2017-12635

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this…

Severity
Critical 9.8
Published
14 Nov 2017
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.7.0
Exploit chance
100% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 11 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache CouchDBServers and applications · cpe:a:apache:couchdb
  • Every version before 1.7.0
  • Version 2.0.0-rc1
  • Version 2.0.0-rc2
  • Version 2.0.0-rc3
  • Version 2.0.0-rc4
  • Version 2.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-12635
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-12635