PT-2019-12337

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 5.5.0 Description The issue arises when an invalid Remote Cluster Certificate is entered as part of the reference creation in Couchbase Server. The server fails to parse and check the certificate signature,...

PT-2019-12336

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 5.1.0 Description The issue concerns unauthenticated and unauthorized access to the "default" bucket in Couchbase Server. Prior to version 5.0, the "default" bucket allowed read and write access without...

PT-2019-12327

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 4.6.3 through 5.5.0 Description The issue arises when secondary indexing in Couchbase Server encodes entries to be indexed using collatejson. If index entries contain specific characters like t, , it causes a buffer...

PT-2019-12325

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 5.5.x through 5.5.3 Couchbase Server version 6.0.0 Description An issue was discovered where the Memcached "connections" stat block command emits a non-redacted username. This resulted in system information submitted ...

PT-2019-12326

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 5.5.0 through 6.0.0 Description The eventing service in Couchbase Server exposes system diagnostic profiles via an HTTP endpoint that does not require credentials on a port intended for internal traffic only...

CVE-2019-11497: Improper Certificate Validation

In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it to establish future connections to the remote cluster. This...

CVE-2019-11464: Improper Neutralization of Input During Web Page Generation

Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and...

PT-2019-12324

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 5.1.2 through 5.5.0 Description The issue concerns the absence of certain security-related headers in REST responses from the Couchbase Server Views REST API. Specifically, headers such as X-Frame-Options,...

PT-2019-12335 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions prior to 6.0.0 Description: The issue arises from the insecure generation of a cookie used for intra-node communication in Couchbase Server. Specifically, the erlang:now function is used to seed the PRNG, resulting i...

CVE-2019-11496: Missing Authentication for Critical Function

In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets including "default" were changed to only allow access by authenticated users with sufficient...

Couchbase Sync Gateway SQL Injection Vulnerability

Couchbase Sync Gateway is a secure Web gateway for data access and data synchronization over the Web from Couchbase Inc. in the United States. A SQL injection vulnerability exists in the REST API in Couchbase Sync Gateway version 2.1.2 Couchbase Server. An attacker could exploit the vulnerability...

CVE-2019-9039

In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters "startkey" and "endkey" on the "alldocs" endpoint. By issuing nested queri...

Design/Logic Flaw

In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters "startkey" and "endkey" on the "alldocs" endpoint. By issuing nested queri...

CVE-2019-9039

In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters "startkey" and "endkey" on the "alldocs" endpoint. By issuing nested queri...

CVE-2019-9039

The CVE-2019-9039 issue affects Couchbase Sync Gateway 2.1.2, where an attacker with access to the public REST API could inject additional N1QL statements via the startkey/endkey parameters on the _all_docs endpoint. The underlying vulnerability is a N1QL injection that could disclose sensitive d...

CVE-2019-9039: Improper Neutralization of Special Elements used in an SQL Command

In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters "startkey" and "endkey" on the "alldocs" endpoint. By issuing nested queri...

PT-2019-19328

Name of the Vulnerable Software and Affected Versions Couchbase Sync Gateway version 2.1.2 Description The issue allows an attacker with access to the Sync Gateway's public REST API to extract sensitive data or call arbitrary N1QL functions through the parameters startkey and endkey on the " all...

CVE-2018-15728

Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the...

Code injection

Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the...

CVE-2018-15728

CVE-2018-15728 affects Couchbase Server where the REST/diag/eval endpoint (on TCP 8091 and/or 18091) could be accessed by authenticated Full Admin users to submit arbitrary Erlang code, which would execute on the underlying OS with the attacker's privileges. Affected versions include 4.0.0, 4.1.2...