CVE-2019-11467: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like \t, , it caused buffer overrun as encoded string would be much larger than accounted for, causing indexer service to crash and restart...

PT-2019-12327

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 4.6.3 through 5.5.0 Description The issue arises when secondary indexing in Couchbase Server encodes entries to be indexed using collatejson. If index entries contain specific characters like t, , it causes a buffer...

PT-2019-12324

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 5.1.2 through 5.5.0 Description The issue concerns the absence of certain security-related headers in REST responses from the Couchbase Server Views REST API. Specifically, headers such as X-Frame-Options,...

PT-2019-12326

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 5.5.0 through 6.0.0 Description The eventing service in Couchbase Server exposes system diagnostic profiles via an HTTP endpoint that does not require credentials on a port intended for internal traffic only...

CVE-2019-11496: Missing Authentication for Critical Function

In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets including "default" were changed to only allow access by authenticated users with sufficient...

CVE-2019-11497: Improper Certificate Validation

In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it to establish future connections to the remote cluster. This...

CVE-2019-11495: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now to seed the PRNG which results in a small search space for potential random seeds that could then be used to brute force the cookie and execute code against a remot...

CVE-2019-11466: Missing Authentication for Critical Function

In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access...

CVE-2019-11465: Insertion of Sensitive Information into Log File

An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The system information submitted to Couchbase as part of a bug report included the usernames for all users currently logged into the system even...

CVE-2019-11464: Improper Neutralization of Input During Web Page Generation

Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and...

PT-2019-12337

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 5.5.0 Description The issue arises when an invalid Remote Cluster Certificate is entered as part of the reference creation in Couchbase Server. The server fails to parse and check the certificate signature,...

PT-2019-12325

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 5.5.x through 5.5.3 Couchbase Server version 6.0.0 Description An issue was discovered where the Memcached "connections" stat block command emits a non-redacted username. This resulted in system information submitted ...

PT-2019-12336

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 5.1.0 Description The issue concerns unauthenticated and unauthorized access to the "default" bucket in Couchbase Server. Prior to version 5.0, the "default" bucket allowed read and write access without...

Couchbase Sync Gateway SQL Injection Vulnerability

Couchbase Sync Gateway is a secure Web gateway for data access and data synchronization over the Web from Couchbase Inc. in the United States. A SQL injection vulnerability exists in the REST API in Couchbase Sync Gateway version 2.1.2 Couchbase Server. An attacker could exploit the vulnerability...

CVE-2018-15728

Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the...

Code injection

Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the...

Couchbase Server Remote Code Execution

Hey, Description: Couchbase Server 1 exposes REST API 2 which by default is available on TCP/8091 and/or TCP/18091. Authenticated users can send arbitrary Erlang code to 'diag/eval' endpoint of the API. The code will be subsequently executed in the underlying operating system with privileges of t...

CVE-2018-15728: Improper Control of Generation of Code

Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the...

PT-2018-13175

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 4.0.0 through 5.5.1 Description The issue allows authenticated users with the 'Full Admin' role to execute arbitrary Erlang code on the underlying operating system with the privileges of the user running Couchbase. Th...