CVE-2010-2234: CSRF
First published: Tue Aug 17 2010(Updated: )
Apache CouchDB prior to 0.11.2 and 1.0.1 are vulnerable to cross site request forgery (CSRF) attacks. A malicious web site can POST arbitrary JavaScript code to wellknown CouchDB installation URLs and make the browser execute the injected JavaScript in the security context of CouchDB's admin interface Futon. This issue has been assigned the name <a href="https://access.redhat.com/security/cve/CVE-2010-2234">CVE-2010-2234</a>. References: <a href="http://seclists.org/fulldisclosure/2010/Aug/199">http://seclists.org/fulldisclosure/2010/Aug/199</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache CouchDB | =0.9.0 | |
| Apache CouchDB | =0.9.1 | |
| Apache CouchDB | =0.11.0 | |
| Apache CouchDB | =0.8.1 | |
| Apache CouchDB | =0.10.1 | |
| Apache CouchDB | =0.9.2 | |
| Apache CouchDB | =0.10.0 | |
| Apache CouchDB | =0.8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://seclists.org/fulldisclosure/2010/Aug/199
- https://bugzilla.redhat.com/show_bug.cgi?id=624764
- http://www.securityfocus.com/bid/42501
- http://www.securityfocus.com/archive/1/513174/100/0/threaded
- https://access.redhat.com/security/cve/CVE-2010-2234
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=624765
Frequently Asked Questions
What is the severity of CVE-2010-2234?
CVE-2010-2234 is classified as a medium severity vulnerability due to its potential for cross site request forgery attacks.
How can I fix CVE-2010-2234?
To fix CVE-2010-2234, update your Apache CouchDB installation to version 0.11.2 or 1.0.1 or later.
What systems are affected by CVE-2010-2234?
CVE-2010-2234 affects Apache CouchDB versions 0.8.0 through 0.11.0, and 0.9.x up to 0.9.2.
What type of attack is described in CVE-2010-2234?
CVE-2010-2234 describes a cross site request forgery (CSRF) attack that can exploit vulnerabilities in CouchDB.
What can attackers do using CVE-2010-2234?
Attackers can use CVE-2010-2234 to POST arbitrary JavaScript code to CouchDB installation URLs, executing it in the context of the application's admin interface.
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-2234
- agent/trending
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/apache
- canonical/apache couchdb
- version/apache couchdb/0.9.0
- version/apache couchdb/0.9.1
- version/apache couchdb/0.11.0
- version/apache couchdb/0.8.1
- version/apache couchdb/0.10.1
- version/apache couchdb/0.9.2
- version/apache couchdb/0.10.0
- version/apache couchdb/0.8.0