CVE-2022-42951

CWE-287 — Improper AuthenticationCWE-362 — Race Condition3 documents3 sources
Severity
8.1HIGH
EPSS
0.5%
top 34.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Couchbase Couchbase Server
Timeline
PublishedFeb 6

Description

An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages1 packages

▶NVDcouchbase/couchbase_server6.5.0 — 6.6.6+2

🔴Vulnerability Details

2
CVEList
CVE-2022-42951: An issue was discovered in Couchbase Server 6↗2023-02-06
▶
GHSA
GHSA-jhxg-8fv9-xvgm: An issue was discovered in Couchbase Server 6↗2023-02-06
▶
CVE-2022-42951 (HIGH CVSS 8.1) | An issue was discovered in Couchbas | cvebase.io