Bug 624764 (CVE-2010-2234)

Summary:	CVE-2010-2234 couchdb: CSRF vulnerability in versions prior to 0.11.2/1.0.1
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	lemenkov
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:57:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	624765
Bug Blocks:

Description Vincent Danen 2010-08-17 17:04:00 UTC

Apache CouchDB prior to 0.11.2 and 1.0.1 are vulnerable to cross site request forgery (CSRF) attacks.  A malicious web site can POST arbitrary JavaScript code to wellknown CouchDB installation URLs and make the browser execute the injected JavaScript in the security context of CouchDB's admin interface Futon.

This issue has been assigned the name CVE-2010-2234.

References:

http://seclists.org/fulldisclosure/2010/Aug/199

Comment 1 Vincent Danen 2010-08-17 17:05:27 UTC

Created couchdb tracking bugs for this issue

Affects: fedora-all [bug 624765]

Comment 2 Product Security DevOps Team 2019-06-10 10:57:09 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.