Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators for direct requests to an installation URL.

Despite the fact that this is a security-related fix I would like to test these packages for a while because of possible API incompatibilities (version upgrade).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of CouchDB running on the remote host is affected by a cross-site request forgery vulnerability. The application fails to properly sanitize user-supplied input before it is used in the Futon admin interface.

A remote attacker could exploit this to execute arbitrary script code in the security context of CouchDB's admin interface.

The remote host is running CouchDB, a document-oriented database.

Versions of CouchDB earlier than 0.11.2 are potentially affected by a cross-site request forgery vulnerability.  The application fails to properly sanitize user-supplied input before it is used in the Futon administrative interface.

 remote attacker could exploit this to execute arbitrary script code in the security context of CouchDB's admin interface.

ID	Name	Product	Family	Severity
49294	Fedora 12 : couchdb-0.11.2-2.fc12 (2010-13665)	Nessus	Fedora Local Security Checks	medium
49293	Fedora 13 : couchdb-0.11.2-2.fc13 (2010-13640)	Nessus	Fedora Local Security Checks	medium
48382	Apache CouchDB < 0.11.2 Futon admin interface Cross-Site Request Forgery	Nessus	Databases	medium
5642	CouchDB < 0.11.2 Futon Admin Interface Cross-Site Request Forgery	Nessus Network Monitor	Database	medium

Detections

Analytics

CVE-2010-2234

high

Tenable Plugins

medium

medium

medium

medium