Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

- Fixed Futon test failures with Erlang/OTP R14B02

    - Ver. 1.0.2 (Bugfix release)

    - Ver. 1.0.2 (Bugfix release)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Ver. 1.0.2 (Bugfix release)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of CouchDB running on the remote host is affected by a cross-site scripting vulnerability.  The application fails to properly sanitize user-supplied input before it is used in the Futon admin interface. 

A remote attacker could exploit this to execute arbitrary script code in the security context of CouchDB's admin interface.

Note that Nessus did not actually test for the flaw but instead has relied on the version in CouchDB's banner so this may be a false positive.

The remote host is running CouchDB, a document-oriented database.  

Versions of CouchDB earlier than 1.0.2 are potentially affected by a cross-site scripting vulnerability.  The application fails to properly sanitize user-supplied input before it is used in the Futon administrative interface.  A remote attacker could exploit this to execute arbitrary script code in the security context of CouchDB's admin interface.

ID	Name	Product	Family	Severity
54976	Fedora 14 : couchdb-1.0.2-4.fc14 (2011-7232)	Nessus	Fedora Local Security Checks	medium
52516	Fedora 15 : couchdb-1.0.2-1.fc15 (2011-1513)	Nessus	Fedora Local Security Checks	medium
51923	Apache CouchDB < 1.0.2 Futon Admin Interface XSS	Nessus	Databases	medium
5755	CouchDB < 1.0.2 Cross Site Scripting Issue	Nessus Network Monitor	Database	low

Detections

Analytics

CVE-2010-3854

medium

Tenable Plugins

medium

medium

medium

low