CVE-2012-5649: Code Injection
Published May 23, 2014
·Updated
Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to execute arbitrary code via a JSONP callback, related to Adobe Flash.
Affected Software
7 affected components
Apache CouchDB<=1.0.3
Apache CouchDB=1.0.0
Apache CouchDB=1.0.1
Apache CouchDB=1.0.2
Apache CouchDB=1.1.0
Apache CouchDB=1.1.1
Apache CouchDB=1.2.0
Event History
May 23, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:55 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2012-5649?
CVE-2012-5649 is considered to have a high severity rating due to its potential for remote code execution.
2
How do I fix CVE-2012-5649?
To fix CVE-2012-5649, upgrade your Apache CouchDB to version 1.0.4, 1.1.2, or 1.2.1 or later.
3
What versions of Apache CouchDB are affected by CVE-2012-5649?
CVE-2012-5649 affects Apache CouchDB versions prior to 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1.
4
What types of attacks are possible with CVE-2012-5649?
CVE-2012-5649 allows remote attackers to execute arbitrary code via a JSONP callback, which can lead to severe security breaches.
5
Is there a workaround for CVE-2012-5649 if I cannot upgrade?
There are no known effective workarounds for CVE-2012-5649, so upgrading is the recommended method to mitigate the vulnerability.