PT-2011-1443 · Apache · Apache Couchdb

Published 2011-02-02 · Updated 2023-02-13 · CVE-2010-3854

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache CouchDB versions 0.8.0 through 1.0.1

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the web administration interface of Apache CouchDB. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Recommendations For Apache CouchDB versions 0.8.0 through 1.0.1, update to a version that contains a fix for this issue to prevent exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-3854

Affected Products

Apache Couchdb

References · 10

• http://secunia.com/advisories/43111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3854 · Security Note
• http://vupen.com/english/advisories/2011/0263 · Vendor Advisory
• http://securityfocus.com/bid/46066 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65050 · Note
• http://osvdb.org/70734 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3854 · Note
• http://securityfocus.com/archive/1/516058/100/0/threaded · Note
• http://mail-archives.apache.org/mod_mbox/couchdb-dev/201101.mbox/%3CC840F655-C8C5-4EC6-8AA8-DD223E39C34A%40apache.org%3E · Note
• http://securitytracker.com/id?1025013 · Note