CVE-2010-2234: CSRF
First published: Tue Aug 17 2010(Updated: )
Apache CouchDB prior to 0.11.2 and 1.0.1 are vulnerable to cross site request forgery (CSRF) attacks. A malicious web site can POST arbitrary JavaScript code to wellknown CouchDB installation URLs and make the browser execute the injected JavaScript in the security context of CouchDB's admin interface Futon. This issue has been assigned the name <a href="https://access.redhat.com/security/cve/CVE-2010-2234">CVE-2010-2234</a>. References: <a href="http://seclists.org/fulldisclosure/2010/Aug/199">http://seclists.org/fulldisclosure/2010/Aug/199</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache CouchDB | =0.9.0 | |
| Apache CouchDB | =0.9.1 | |
| Apache CouchDB | =0.11.0 | |
| Apache CouchDB | =0.8.1 | |
| Apache CouchDB | =0.10.1 | |
| Apache CouchDB | =0.9.2 | |
| Apache CouchDB | =0.10.0 | |
| Apache CouchDB | =0.8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://seclists.org/fulldisclosure/2010/Aug/199
- https://bugzilla.redhat.com/show_bug.cgi?id=624764
- http://www.securityfocus.com/bid/42501
- http://www.securityfocus.com/archive/1/513174/100/0/threaded
- https://access.redhat.com/security/cve/CVE-2010-2234
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=624765
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-2234
- agent/tags
- agent/trending
- vendor/apache
- canonical/apache couchdb
- version/apache couchdb/0.9.0
- version/apache couchdb/0.9.1
- version/apache couchdb/0.11.0
- version/apache couchdb/0.8.1
- version/apache couchdb/0.10.1
- version/apache couchdb/0.9.2
- version/apache couchdb/0.10.0
- version/apache couchdb/0.8.0