title: Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes
description: Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:
*  validate_doc_update
*  list
*  filter
*  filter views (using view functions as filters)
*  rewrite
*  update
This doesn't affect map/reduce or search (Dreyfus) index functions.
Users are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3).
Workaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: affected
product: Apache CouchDB
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 3.3.1, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: IBM Cloudant
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 8349, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL