Couchbase Archives - CVE Vulnerability

CVE-2020-9041

Sun, 26 Feb 2023 06:43:37 +0000

In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are vulnerable to the Slowloris denial-of-service attack because they don’t more aggressively terminate slow connections.

The post CVE-2020-9041 appeared first on CVE Vulnerability.

CVE-2020-9040

Sun, 26 Feb 2023 06:43:37 +0000

Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer. An attacker can leverage this flaw by crafting a cryptographically valid certificate that will be accepted by Java SDK’s Netty component due to missing hostname verification.

The post CVE-2020-9040 appeared first on CVE Vulnerability.

CVE-2021-43963

Thu, 23 Feb 2023 14:12:35 +0000

An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Server were insecurely being stored in the metadata within sync documents written to the bucket. Users with read access could use these credentials to obtain write access. (This issue does not affect clusters where Sync Gateway is authenticated with X.509 client certificates. This issue also does not affect clusters where shared bucket access is not enabled on Sync Gateway.)

The post CVE-2021-43963 appeared first on CVE Vulnerability.

CVE-2021-35943

Thu, 23 Feb 2023 14:10:34 +0000

Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC4513.

The post CVE-2021-35943 appeared first on CVE Vulnerability.

CVE-2021-33504

Thu, 23 Feb 2023 14:10:01 +0000

Couchbase Server before 7.1.0 has Incorrect Access Control.

The post CVE-2021-33504 appeared first on CVE Vulnerability.

CVE-2021-27925

Thu, 23 Feb 2023 14:08:41 +0000

An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condition can (depending on a race condition) cause an internal user with administrator privileges, @ns_server, to have its credentials leaked in cleartext in the ns_server.info.log file.

The post CVE-2021-27925 appeared first on CVE Vulnerability.

CVE-2022-42951

godfreyd94 — Thu, 23 Feb 2023 05:21:05 +0000

An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials.

The post CVE-2022-42951 appeared first on CVE Vulnerability.

CVE-2022-42950

godfreyd94 — Thu, 23 Feb 2023 05:21:05 +0000

An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service.

The post CVE-2022-42950 appeared first on CVE Vulnerability.

CVE-2022-34826

godfreyd94 — Thu, 23 Feb 2023 05:19:31 +0000

In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.

The post CVE-2022-34826 appeared first on CVE Vulnerability.

CVE-2022-33911

godfreyd94 — Thu, 23 Feb 2023 05:19:18 +0000

An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized Actor may be able to obtain Sensitive Information.

The post CVE-2022-33911 appeared first on CVE Vulnerability.