CVE-2025-46619

syedaquib77

Threat Alert: CVE-2025-46619: LFI Vulnerability in Couchbase Server for Windows Date: 2025-05-02 Timeline: Vulnerability disclosed and patches released by vendor as of May 2, 2025. Summary: Couchbase Server for Windows is affected by a serious Local File Inclusion (LFI) vulnerability tracked as CVE-2025-46619 with a CVSS score of 8.7. This flaw allows attackers with local or indirect privileges to gain unauthorized access to sensitive system files such as / etc / passwd or / etc / shadow. Multiple versions from 2.x through 7.6.3 are vulnerable. The vendor has released patched versions 7.6.4 and 7.2.7 to mitigate this risk. The vulnerability poses a significant risk depending on the user privilege context and could lead to unauthorized file access on affected deployments. Attack Details: - Attack Type: Local File Inclusion (LFI) Exploit - Target: Couchbase Server for Windows installations Attack Vectors: - T1190 - Exploit Public-Facing Application - T1105 - Ingress Tool Transfer Impact: Unauthorized access to sensitive system files potentially leading to data exposure and further exploitation depending on privilege level. CVSS base score 8.7 indicates high severity. No specific reported financial losses were identified. Recommended Actions: - Upgrade affected Couchbase Server for Windows to patched versions 7.6.4 or 7.2.7 immediately to mitigate the vulnerability. - Limit local access and privileges to reduce risk. - Monitor systems for unusual file access attempts related to the vulnerability. Related Resources: - https://t.co/je5qzvrLll Tags: #LFI #Vulnerability #CouchbaseServer #Windows #CVE202546619 #Patch #SecurityAdvisory #Cybersecurity

Komodosec

#Vulnerability #Couchbase CVE-2025-46619: LFI Vulnerability Affects Multiple Versions of Couchbase Server for Windows