Description
Due to differences in CouchDB's Erlang-based JSON parser and JavaScript-based JSON parser, it is possible to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with 'CVE-2017-12636' (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user.
Remediation
Upgrade to the latest version of CouchDB
References
Related Vulnerabilities
WordPress Plugin Simplr Registration Form Plus+ Privilege Escalation (2.4.3)
WordPress Plugin Jigoshop-Store Toolkit Privilege Escalation (1.3.8)
WordPress Plugin WooCommerce-Store Toolkit Privilege Escalation (1.5.7)
Improper Authorization in Confluence Server and Data Center (CVE-2023-22518)
WordPress Plugin Jigoshop-Store Toolkit Privilege Escalation (1.3.7)