# 16.3. CVE-2010-3854: Apache CouchDB Cross Site Scripting Issue

Date: | 28.01.2011
Affected: | Apache CouchDB 0.8.0 to 1.0.1
Severity: | Important
Vendor: | The Apache Software Foundation

## 16.3.1. Description

Apache CouchDB versions prior to version 1.0.2 are vulnerable to Cross Site Scripting (XSS) attacks.

## 16.3.2. Mitigation

All users should upgrade to CouchDB 1.0.2.

Upgrades from the 0.11.x and 0.10.x series should be seamless.

Users on earlier versions should consult with upgrade notes.

## 16.3.3. Example

Due to inadequate validation of request parameters and cookie data in Futon, CouchDB’s web-based administration UI, a malicious site can execute arbitrary code in the context of a user’s browsing session.

## 16.3.4. Credit

This XSS issue was discovered by a source that wishes to stay anonymous.