CVE-2010-2234: CSRF

First published: Tue Aug 17 2010(Updated: )

Apache CouchDB prior to 0.11.2 and 1.0.1 are vulnerable to cross site request forgery (CSRF) attacks. A malicious web site can POST arbitrary JavaScript code to wellknown CouchDB installation URLs and make the browser execute the injected JavaScript in the security context of CouchDB's admin interface Futon. This issue has been assigned the name <a href="https://access.redhat.com/security/cve/CVE-2010-2234">CVE-2010-2234</a>. References: <a href="http://seclists.org/fulldisclosure/2010/Aug/199">http://seclists.org/fulldisclosure/2010/Aug/199</a>

Credit: secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-historical
• collector/nvd-index
• agent/references
• agent/type
• agent/first-publish-date
• agent/softwarecombine
• collector/mitre-cve
• source/MITRE
• agent/severity
• agent/last-modified-date
• agent/author
• agent/weakness
• agent/description
• agent/event
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2010-2234
• agent/trending
• agent/tags
• agent/source
• vendor/apache
• canonical/apache couchdb
• version/apache couchdb/0.9.0
• version/apache couchdb/0.9.1
• version/apache couchdb/0.11.0
• version/apache couchdb/0.8.1
• version/apache couchdb/0.10.1
• version/apache couchdb/0.9.2
• version/apache couchdb/0.10.0
• version/apache couchdb/0.8.0