4.3

CVE-2010-0009

Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Couchdb Version 0.8.0
Apache ≫ Couchdb Version 0.8.1
Apache ≫ Couchdb Version 0.9.0
Apache ≫ Couchdb Version 0.9.1
Apache ≫ Couchdb Version 0.9.2
Apache ≫ Couchdb Version 0.10.0
Apache ≫ Couchdb Version 0.10.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.35% 0.916
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://archives.neohapsis.com/archives/bugtraq/2010-03/0267.html
http://couchdb.apache.org/security.html
Patch
Vendor Advisory
http://secunia.com/advisories/39146
Vendor Advisory
http://www.osvdb.org/63350
http://www.securityfocus.com/archive/1/510427/100/0/threaded
http://www.securityfocus.com/bid/39116
https://bugzilla.redhat.com/show_bug.cgi?id=578572