CVE-2023-43769: Undefined Security Weakness

An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed in Analytics...

CVE-2023-50436: Insufficiently Protected Credentials

An issue was discovered in Couchbase Server before 7.2.4. nsserver admin credentials are leaked in encoded form in the diag.log file. The earliest affected version is 7.1.5...

CVE-2024-23302: Exposure of Sensitive Information to an Unauthorized Actor

Couchbase Server before 7.2.4 has a private key leak in goxdcr.log...

CVE-2023-49338: Incorrect Default Permissions

Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost...

CVE-2023-49930

An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted...

CVE-2023-45874: Uncontrolled Resource Consumption

An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service outage of reader threads...

CVE-2023-49931

An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted...

CVE-2023-50437

An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2...

PT-2024-13837

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 7.2.4 Description An issue was discovered that allows an attacker to bypass SQL++ N1QL cURL host restrictions. Recommendations For versions prior to 7.2.4, update to version 7.2.4 or later to resolve the issu...

Couchbase Server Security Vulnerability

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server versions prior to 7.2.4, which stems from the /admin/stats and...

PT-2024-13836 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions prior to 7.2.4 Description: An issue was discovered where SQL++ cURL calls to the "/diag/eval" API endpoint are not sufficiently restricted. Recommendations: For versions prior to 7.2.4, update to version 7.2.4 or...

CVE-2023-45873

An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service application exist because of the OOM killer...

CVE-2023-49338

Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost...

PT-2024-13729 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions 7.1.x through 7.2.3 Description: The issue concerns the lack of authentication requirement for certain API endpoints. Specifically, the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost do not...

CVE-2023-49338

Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost...

CVE-2023-43769

An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed in Analytics...

CVE-2023-43769

Couchbase Server versions through 7.1.4 (before 7.1.5 ) and before 7.2.1 are affected by a vulnerability where unauthenticated RMI service ports are exposed in the Analytics component. This exposure poses a significant risk as it could allow an attacker to escalate privileges . To resolve this is...

CVE-2023-49931: Improper Access Control

An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted...

CVE-2023-49932

An issue was discovered in Couchbase Server before version 7.2.4 where an attacker can bypass SQL++ N1QL cURL host restrictions . Exploitation details are not provided in the documents. No specific remediation or patch version is stated, though the vulnerability was addressed in version 7.2.4 .

docs.couchbase.com Cross Site Scripting vulnerability OBB-3851217

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...