CVE-2021-42763

Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing the UI request.
References
Configurations

Configuration 1

cpe:2.3:a:couchbase:couchbase_server:7.0.0:-:*:*:*:*:*:*
cpe:2.3:a:couchbase:couchbase_server:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*
cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*
cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*

Information

Published : 2021-11-02 12:15

Updated : 2021-11-08 02:59


NVD link : CVE-2021-42763

Mitre link : CVE-2021-42763

Products Affected
No products.
CWE
CWE-312

Cleartext Storage of Sensitive Information