PT-2024-13295 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions through 7.2.2 Description: An issue was discovered in Couchbase Server where a data reader may cause a denial of service because of the OOM killer, leading to the application exiting. Recommendations: For versions...

CVE-2023-43769

An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed in Analytics...

CVE-2024-23302

Couchbase Server before 7.2.4 has a private key leak in goxdcr.log...

CVE-2023-49931

An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted...

PT-2024-13836 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions prior to 7.2.4 Description: An issue was discovered where SQL++ cURL calls to the "/diag/eval" API endpoint are not sufficiently restricted. Recommendations: For versions prior to 7.2.4, update to version 7.2.4 or...

CVE-2023-43769

CVE-2023-43769 affects Couchbase Server up to 7.1.4 (before 7.1.5) and before 7.2.1. The issue is that unauthenticated RMI service ports are exposed in Analytics, enabling potential unauthorized access. The available sources consistently identify Analytics as the exposed interface and indicate th...

Couchbase Server Security Vulnerability

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server versions prior to 7.2.4, which stems from the /admin/stats and...

CVE-2023-45874

An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service outage of reader threads...

CVE-2024-23302

Couchbase Server before 7.2.4 has a private key leak in goxdcr.log...

CVE-2023-45873

An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service application exist because of the OOM killer...

CVE-2023-45874

CVE-2023-45874 affects Couchbase Server up to version 7.2.2. The issue is caused by a data reader that may cause a denial of service, leading to an outage of reader threads. The CVSS base score is 4.3 (Medium) with network attack vector and low privileges required. No exploitation details are pro...

CVE-2023-49930

CVE-2023-49930 affects Couchbase Server versions before 7.2.4. The issue is that cURL calls to the "/diag/eval" API endpoint are not sufficiently restricted, enabling access that could impact confidentiality, integrity, and availability. The vulnerability is described with a high severity (CVSS v...

PT-2024-13835 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions prior to 7.2.4 Description: An issue was discovered in Couchbase Server where cURL calls to the "/diag/eval" API endpoint are not sufficiently restricted. Recommendations: For versions prior to 7.2.4, update to versi...

CVE-2023-45874

An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service outage of reader threads...

CVE-2023-49932

An issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL host restrictions...

CVE-2023-49932

CVE-2023-49932 affects Couchbase Server versions prior to 7.2.4. The vulnerability allows bypassing SQL++ N1QL cURL host restrictions. The available docs do not provide exploitation details; remediation is upgrading to 7.2.4+ or applying vendor guidance per release notes. CVSS 3.1 base score 5.4 ...

CVE-2024-23302

CVE-2024-23302 affects Couchbase Server prior to version 7.2.4, where a private key leak occurs in the goxdcr.log. The available sources confirm the issue and the affected product/version, but do not provide exploit details or specific remediation steps beyond the exposure described. No root-caus...

CVE-2023-49338

Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost...

CVE-2023-50437

CVE-2023-50437 affects Couchbase Server prior to 7.2.4. The issue involves otpCookie being shown with full admin on endpoints /pools/default/serverGroups and engageCluster2, indicating overly permissive admin exposure. Root cause is not explicitly detailed beyond the admin-level OTP cookie handli...

CVE-2023-50436

CVE-2023-50436 affects Couchbase Server prior to 7.2.4. The issue leaks admin credentials (ns_server) encoded in diag.log, with earliest affected version 7.1.5. Connected sources confirm the vulnerability is limited to 7.1.5–7.2.3 and that upgrading to 7.2.4 or later resolves the vulnerability. T...