REDHAT-BUG-624764: CSRF
First published: Tue Aug 17 2010(Updated: )
Apache CouchDB prior to 0.11.2 and 1.0.1 are vulnerable to cross site request forgery (CSRF) attacks. A malicious web site can POST arbitrary JavaScript code to wellknown CouchDB installation URLs and make the browser execute the injected JavaScript in the security context of CouchDB's admin interface Futon. This issue has been assigned the name <a href="https://access.redhat.com/security/cve/CVE-2010-2234">CVE-2010-2234</a>. References: <a href="http://seclists.org/fulldisclosure/2010/Aug/199">http://seclists.org/fulldisclosure/2010/Aug/199</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache CouchDB | <0.11.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-624764?
The severity of REDHAT-BUG-624764 is high due to the potential for cross site request forgery (CSRF) attacks.
How do I fix REDHAT-BUG-624764?
To fix REDHAT-BUG-624764, upgrade Apache CouchDB to version 0.11.2 or later.
What versions of CouchDB are affected by REDHAT-BUG-624764?
Apache CouchDB versions prior to 0.11.2 and 1.0.1 are vulnerable to REDHAT-BUG-624764.
What type of attack does REDHAT-BUG-624764 involve?
REDHAT-BUG-624764 involves cross site request forgery (CSRF) attacks enabling malicious JavaScript execution.
Who is responsible for addressing REDHAT-BUG-624764?
System administrators and users of Apache CouchDB are responsible for addressing REDHAT-BUG-624764 by applying the necessary updates.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-2234
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/apache couchdb