Unscored severity · published Apr 5, 2010
CVE-2010-0009
Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords
–
CVSS
5.3%
EPSS
No
On KEV
Description
Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.3% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Couchdb · Apache
0.8.0; 0.8.1; 0.9.0; 0.9.1; 0.9.2; 0.10.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-0009
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-0009
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2010-03/0267.html
Patch
http://couchdb.apache.org/security.html
Vendor Advisory
http://secunia.com/advisories/39146
www.osvdb.org
http://www.osvdb.org/63350
www.securityfocus.com
http://www.securityfocus.com/archive/1/510427/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/39116
More from Couchdb
9.8
CVE-2022-24706
Remote Code Execution Vulnerability in Packaging
9.8
CVE-2020-1955
CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_up`
9.8
CVE-2017-12635
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents…
7.8
CVE-2018-14889
CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability
7.8
CVE-2016-8742
The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation