CVE-2021-25645 — Cleartext Storage of Sensitive Info in Server

CWE-312 — Cleartext Storage of Sensitive Info3 documents3 sources
Severity
4.4MEDIUMNVD
EPSS
0.0%
top 93.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Couchbase Server
Timeline
PublishedMay 10
Latest updateMay 24

Description

An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 0.8 | Impact: 3.6

Affected Packages1 packages

▶NVDcouchbase/couchbase_server6.1.0 — 6.5.2+2

🔴Vulnerability Details

2
GHSA
GHSA-85q4-jrg3-8hqc: An issue was discovered in Couchbase Server before 6↗2022-05-24
▶
CVEList
CVE-2021-25645: An issue was discovered in Couchbase Server before 6↗2021-05-10
▶
CVE-2021-25645 — Cleartext Storage of Sensitive Info | cvebase