CVE-2010-2234: CSRF
Apache CouchDB prior to 0.11.2 and 1.0.1 are vulnerable to cross site request forgery (CSRF) attacks. A malicious web site can POST arbitrary JavaScript code to wellknown CouchDB installation URLs and make the browser execute the injected JavaScript in the security context of CouchDB's admin interface Futon.
This issue has been assigned the name CVE-2010-2234.
References:
http://seclists.org/fulldisclosure/2010/Aug/199
Other sources
Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators for direct requests to an installation URL.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2234?
CVE-2010-2234 is classified as a medium severity vulnerability due to its potential for cross site request forgery attacks.
How can I fix CVE-2010-2234?
To fix CVE-2010-2234, update your Apache CouchDB installation to version 0.11.2 or 1.0.1 or later.
What systems are affected by CVE-2010-2234?
CVE-2010-2234 affects Apache CouchDB versions 0.8.0 through 0.11.0, and 0.9.x up to 0.9.2.
What type of attack is described in CVE-2010-2234?
CVE-2010-2234 describes a cross site request forgery (CSRF) attack that can exploit vulnerabilities in CouchDB.
What can attackers do using CVE-2010-2234?
Attackers can use CVE-2010-2234 to POST arbitrary JavaScript code to CouchDB installation URLs, executing it in the context of the application's admin interface.