CVE-2012-5650: XSS
First published: Tue Mar 18 2014(Updated: )
Cross-site scripting (XSS) vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the browser-based test suite.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache CouchDB | <=1.0.3 | |
| Apache CouchDB | =1.0.0 | |
| Apache CouchDB | =1.0.1 | |
| Apache CouchDB | =1.0.2 | |
| Apache CouchDB | =1.1.0 | |
| Apache CouchDB | =1.1.1 | |
| Apache CouchDB | =1.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://archives.neohapsis.com/archives/bugtraq/2013-01/0056.html
- http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E
- http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F%40apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2012-5650?
The severity of CVE-2012-5650 is rated as medium due to the potential for remote code execution through cross-site scripting.
How do I fix CVE-2012-5650?
To fix CVE-2012-5650, you should upgrade Apache CouchDB to version 1.0.4, 1.1.2, 1.2.1, or later.
What versions of Apache CouchDB are affected by CVE-2012-5650?
CVE-2012-5650 affects Apache CouchDB versions prior to 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1.
What type of vulnerability is CVE-2012-5650?
CVE-2012-5650 is a cross-site scripting (XSS) vulnerability.
Can CVE-2012-5650 be exploited remotely?
Yes, CVE-2012-5650 allows remote attackers to inject arbitrary web scripts or HTML.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/apache couchdb
- version/apache couchdb/1.0.3
- version/apache couchdb/1.0.0
- version/apache couchdb/1.0.1
- version/apache couchdb/1.0.2
- version/apache couchdb/1.1.0
- version/apache couchdb/1.1.1
- version/apache couchdb/1.2.0