Couchbase Server vulnerabilities

CVE-2021-25644 [HIGH] CWE-312 CVE-2021-25644: An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect comm An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators.

CVE-2023-50782 [HIGH] CWE-203 CVE-2023-50782: A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decry A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

CVE-2023-43768 [HIGH] CWE-770 CVE-2023-43768: An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthentic An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via large commands.

CVE-2021-42763 [HIGH] CWE-312 CVE-2021-42763: Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The is Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing th

CVE-2020-9042 [HIGH] CWE-352 CVE-2020-9042: In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request.

CVE-2022-32564 [HIGH] CVE-2022-32564: An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie.

CVE-2022-32192 [HIGH] CWE-200 CVE-2022-32192: Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.

CVE-2024-23302 [HIGH] CWE-200 CVE-2024-23302: Couchbase Server before 7.2.4 has a private key leak in goxdcr.log. Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.

CVE-2021-37842 [HIGH] CWE-312 CVE-2021-37842: metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it.

CVE-2022-32558 [HIGH] CVE-2022-32558: An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal us An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal user passwords during a failure.

CVE-2022-33173 [HIGH] CVE-2022-33173: An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. Analytics Remote Links An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. Analytics Remote Links may temporarily downgrade to non-TLS connection to determine the TLS port number, using SCRAM-SHA instead.

CVE-2022-32556 [HIGH] CWE-532 CVE-2022-32556: An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files w An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes.

CVE-2023-25016 [HIGH] CWE-319 CVE-2023-25016: Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Informatio Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.

CVE-2022-32560 [HIGH] CWE-862 CVE-2022-32560: An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing int An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings.

CVE-2023-45875 [HIGH] CWE-200 CVE-2023-45875: An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while ad An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster.

CVE-2019-11467 [HIGH] CWE-119 CVE-2019-11467: In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using coll In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like \t, , it caused buffer overrun as encoded string would be much larger than accounted for, causing indexer service to crash and restart. This has been remedied in versions 5.1.2 and 5.5.2 to ens

CVE-2022-32565 [HIGH] CWE-532 CVE-2022-32565: An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted us An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids.

CVE-2019-11497 [HIGH] CWE-295 CVE-2019-11497: In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the ref In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it to establish future connections to the remote cluster. This has been fixed in version 5.5.0. XDCR now checks the va

CVE-2021-31158 [MEDIUM] CWE-863 CVE-2021-31158: In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queri In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access.

CVE-2020-9041 [HIGH] CWE-404 CVE-2020-9041: In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, q In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are vulnerable to the Slowloris denial-of-service attack because they don't more aggressively terminate slow connections.