CVE-2021-25644

CVE-2021-25644 affects Couchbase Server 5.x and 6.x up to 6.6.1 and 7.0.0 Beta. The issue arises from incorrect commands to the REST API, causing authentication information to be leaked in plaintext in debug.log and info.log files and also shown in the UI accessible to administrators. The provide...

CVE-2021-25645

CVE-2021-25645 affects Couchbase Server versions prior to 6.0.5, 6.1.x–6.5.x prior to 6.5.2, and 6.6.x prior to 6.6.1. An internal admin user (@ns_server) leaks credentials in cleartext to log files (cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, stats.log). The note clarifies that u...

CVE-2021-35943

CVE-2021-35943 affects Couchbase Server 6.5.x and 6.6.x through 6.6.2. Root cause: Incorrect Access Control that allows externally managed users to authenticate with an empty password (RFC4513). Impact per the CVE indicates potential unauthorized access with high confidentiality/integrity/availab...

CVE-2022-42950

CVE-2022-42950 affects Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator to the Couchbase Server Backup Service can exhaust memory, causing the process to be killed and resulting in denial of service. Red Hat and NVD entries corroborate th...

CVE-2022-42951

The CVE-2022-42951 entry applies to Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During node startup, a brief window exists before cluster management authentication starts in which an attacker can connect to the cluster manager using default credentials...

CVE-2021-37842

CVE-2021-37842 affects Couchbase Server 7.0.0 (metakv). The issue arises from using cleartext storage of sensitive information, enabling potential leakage of Remote Cluster XDCR credentials in debug logs when a config key being logged has an attached tombstone purge timestamp. The Connected docum...

CVE-2023-43768

CVE-2023-43768 affects Couchbase Server 6.6.x through 7.2.0, and pre-7.2.1 releases (before 7.1.5 and 7.2.1). Unauthenticated users can cause memcached to exhaust memory by issuing large commands. Red Hat notes the issue across Couchbase Server 6.6.x–7.2.0 and 7.1.5–7.2.0, while CNNVD describes a...

CVE-2021-35945

CVE-2021-35945 affects Couchbase Server 6.5.x, 6.6.0–6.6.2, and 7.0.0, with a buffer overflow arising from out-of-bounds handling of network packets in memcached. An attacker can crash memcached by sending a crafted network packet. The connected documents provide concrete product/version details ...

CVE-2021-35944

CVE-2021-35944 affects Couchbase Server 6.5.x, 6.6.x up to 6.6.2, and 7.0.0. The issue is a buffer overflow caused by out-of-bounds access in network packet processing within memcached, which can cause memcached to crash when a crafted packet is received. Concrete technical details about affected...

CVE-2020-9041

The CVE-2020-9041 vulnerability affects Couchbase Server 6.0.3 and Couchbase Sync Gateway up to 2.7.0. The cluster management, views, query, and full-text search endpoints are vulnerable to a Slowloris denial-of-service attack due to insufficient termination of slow connections. Impact is Denial ...

CVE-2021-42763

CVE-2021-42763 affects Couchbase Server prior to 6.6.3 and 7.x prior to 7.0.2, where sensitive information is stored in cleartext in Basic Auth headers as UI requests are proxied between cluster manager components. The backtrace shows the HTTP request containing user credentials of the node proce...

CVE-2022-33173

CVE-2022-33173 affects Couchbase Server before 7.0.4. The vulnerability is an algorithm-downgrade issue in Analytics Remote Links that may temporarily downgrade to a non-TLS connection to determine the TLS port number, using SCRAM-SHA. The connected documents confirm the product/version scope and...

CVE-2020-9042

The provided sources describe a CSRF vulnerability in Couchbase Server 6.0 where credentials cached in a browser can be abused to perform a CSRF attack if an administrator has used the browser to view REST API results. Concrete exploit/impact details beyond this (specific vectors, affected versio...