CVE-2023-45875

An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster...

PT-2023-25669 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions 7.1.4 through 7.1.4 Couchbase Server versions 7.2.0 through 7.2.0 Description: The issue allows Directory Traversal. Recommendations: For Couchbase Server version 7.1.4, update to version 7.1.5 or later. For Couchbas...

CVE-2023-36667

Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal...

CVE-2023-45875

CVE-2023-45875 affects Couchbase Server 7.2.0, where a private key leak can occur in debug.log when adding a pre-7.0 node to a 7.2 cluster. The available connected sources describe the issue and its context but do not provide a specific remediation or patched version within the documents. Practic...

CVE-2023-45875: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster...

Couchbase Server Security Vulnerability

Couchbase Server is a distributed open-source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text search and active global replication. A security vulnerability exists in Couchbase Server version 7.2.0, which stems from a private key leak in debug.log...

Couchbase Server Security Vulnerability

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server that stems from the presence of a directory traversal vulnerabilit...

CVE-2023-36667: Improper Limitation of a Pathname to a Restricted Directory

Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal...

This Week in Spring - July 18th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in crazy cool Kuala Lumpur, Malaysia. If you're around, I'll be doing a presentation this Thursday the 20th of July, and I'd love to see you there! Then, after a quick vacation, it's off to Tokyo, Japan, where I'll also b...

CVE-2023-28470

In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication...

CVE-2023-28470

In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication...

Authentication flaw

In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication...

CVE-2023-28470

In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication...

CVE-2023-28470

In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication...

PT-2023-21740 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions 5 through 7.1.3 Description: The issue concerns the accessibility of the "nsstats endpoint" without authentication. Recommendations: For Couchbase Server versions 5 through 7.1.3, update to version 7.1.4 or later to...

Couchbase Server 访问控制错误漏洞

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server versions 5.x through 7.x prior to 7.1.4, which stems from access...

CVE-2023-28470: Missing Authentication for Critical Function

In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication...

CVE-2023-28470

CVE-2023-28470 affects Couchbase Server 5.x–7.x prior to 7.1.4. The nsstats endpoint can be accessed without authentication, representing an authentication bypass in the statistics endpoint. Supported details from multiple sources confirm affected versions and the fix: upgrade to 7.1.4 or later t...

CVE-2022-42951

An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time before the cluster management authentication has started where an attacker can connect to the cluster...

CVE-2022-42950

An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service...