# 2.3. CVE-2010-3854: Apache CouchDB Cross Site Scripting Issue

Date:

  28.01.2011

Affected:

  Apache CouchDB 0.8.0 to 1.0.1

Severity:

  Important

Vendor:

  The Apache Software Foundation

## 2.3.1. Description

Apache CouchDB versions prior to version 1.0.2 are vulnerable to Cross Site Scripting (XSS) attacks.

## 2.3.2. Mitigation

All users should upgrade to CouchDB 1.0.2.

Upgrades from the 0.11.x and 0.10.x series should be seamless.

Users on earlier versions should consult with upgrade notes.

## 2.3.3. Example

Due to inadequate validation of request parameters and cookie data in Futon, CouchDB’s web-based administration UI, a malicious site can execute arbitrary code in the context of a user’s browsing session.

## 2.3.4. Credit

This XSS issue was discovered by a source that wishes to stay anonymous.