Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1, allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the default URI.

The remote application server is affected by potential information disclosure related to a remote directory traversal vulnerability. The vendor has released EBF files (patches) for the affected versions.

The remote host is running CouchDB, a document-oriented database.  

Versions of CouchDB earlier than 1.0.4, 1.1.x earlier than 1.1.2 or 1.2.x earlier than 1.2.1. It is therefore potentially affected by the following vulnerabilities :

  - An unspecified error exists in the included MochiWeb HTTP library that can allow access to arbitrary files via directory traversal attacks. Note that reportedly, this issue only affects installs on Windows hosts. (CVE-2012-5641)

  - An error related to JSONP callbacks can allow an unspecified cross-site scripting attack. (CVE-2012-5649)

  - An input validation error exists related to unspecified query parameters and the Futon UI that can allow DOM-based cross-site scripting attacks. (CVE-2012-5650)

According to its banner, the version of CouchDB running on the remote host is earlier than 1.0.4, 1.1.x earlier than 1.1.2 or 1.2.x earlier than 1.2.1.  It is, therefore, potentially affected by the following vulnerabilities :

  - An unspecified error exists in the included MochiWeb     HTTP library that can allow access to arbitrary files     via directory traversal attacks. Note that reportedly,     this issue only affects installs on Windows hosts.
    (CVE-2012-5641)

  - An error related to JSONP callbacks can allow an     unspecified cross-site scripting attack. (CVE-2012-5649)

  - An input validation error exists related to unspecified     query parameters and the Futon UI that can allow DOM-     based cross-site scripting attacks. (CVE-2012-5650)

Note that Nessus did not actually test for these flaws but instead, has relied on the version in CouchDB's banner.

ID	Name	Product	Family	Type	Severity
6902	EAServer <= 6.3.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers		medium
6796	Apache CouchDB < 1.0.4 / 1.1.2 / 1.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Database		low
63642	Apache CouchDB < 1.0.4 / 1.1.2 / 1.2.1 Multiple Vulnerabilities	Nessus	Databases	Remote	medium

Detections

Analytics

CVE-2012-5641

high

Tenable Plugins

medium

low

medium