Couchbase Server Open source NOSQL database
By the Year
In 2023 there have been 3 vulnerabilities in Couchbase Server with an average score of 6.8 out of ten. Last year Couchbase Server had 15 security vulnerabilities published. Right now, Couchbase Server is on track to have less security vulnerabilities in 2023 than it did last year. Last year, the average CVE base score was greater by 0.19
Year | Vulnerabilities | Average Score |
---|---|---|
2023 | 3 | 6.83 |
2022 | 15 | 7.03 |
2021 | 11 | 6.67 |
2020 | 3 | 9.47 |
2019 | 7 | 7.23 |
2018 | 1 | 8.80 |
It may take a day or so for new Couchbase Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Couchbase Server Security Vulnerabilities
An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2
CVE-2022-42950
4.9 - Medium
- February 06, 2023
An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service.
An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2
CVE-2022-42951
8.1 - High
- February 06, 2023
An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials.
Couchbase Server before 6.6.6
CVE-2023-25016
7.5 - High
- February 06, 2023
Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.
Cleartext Transmission of Sensitive Information
An issue was discovered in Couchbase Server before 7.0.4
CVE-2022-32556
7.5 - High
- July 21, 2022
An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes.
Insertion of Sensitive Information into Log File
In Couchbase Server 7.1.x before 7.1.1
CVE-2022-34826
5.9 - Medium
- July 15, 2022
In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.
Inadequate Encryption Strength
An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4
CVE-2022-33173
7.5 - High
- July 12, 2022
An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. Analytics Remote Links may temporarily downgrade to non-TLS connection to determine the TLS port number, using SCRAM-SHA instead.
An issue was discovered in Couchbase Server 7.x before 7.0.4
CVE-2022-33911
5.3 - Medium
- July 12, 2022
An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized Actor may be able to obtain Sensitive Information.
Insertion of Sensitive Information into Log File
An issue was discovered in Couchbase Server before 7.0.4
CVE-2022-32557
7.5 - High
- June 14, 2022
An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers.
AuthZ
An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4
CVE-2022-32561
4.9 - Medium
- June 14, 2022
An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insufficient when it was discovered that diagnostic endpoints could still be accessed from the network.
An issue was discovered in Couchbase Server before 7.0.4
CVE-2022-32559
9.1 - Critical
- June 14, 2022
An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics.
Exposure of Resource to Wrong Sphere
Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
CVE-2022-32192
7.5 - High
- June 13, 2022
Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
Information Disclosure
An issue was discovered in Couchbase Server before 7.0.4
CVE-2022-32562
8.8 - High
- June 13, 2022
An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission.
Incorrect Default Permissions
An issue was discovered in Couchbase Server before 7.0.4
CVE-2022-32565
7.5 - High
- June 13, 2022
An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids.
Insertion of Sensitive Information into Log File
An issue was discovered in Couchbase Server before 7.0.4
CVE-2022-32564
7.5 - High
- June 13, 2022
An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie.
Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
CVE-2022-32193
6.5 - Medium
- June 13, 2022
Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
Insertion of Sensitive Information into Log File
An issue was discovered in Couchbase Server before 7.0.4
CVE-2022-32558
7.5 - High
- June 13, 2022
An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal user passwords during a failure.
An issue was discovered in Couchbase Server before 7.0.4
CVE-2022-32560
7.5 - High
- June 13, 2022
An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings.
authentification
Couchbase Server before 7.1.0 has Incorrect Access Control.
CVE-2021-33504
4.9 - Medium
- June 02, 2022
Couchbase Server before 7.1.0 has Incorrect Access Control.
AuthZ
Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext
CVE-2021-42763
7.5 - High
- November 02, 2021
Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing the UI request.
Cleartext Storage of Sensitive Information
metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information
CVE-2021-37842
7.5 - High
- November 02, 2021
metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it.
Cleartext Storage of Sensitive Information
Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control
CVE-2021-35943
9.8 - Critical
- September 29, 2021
Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC4513.
authentification
Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow
CVE-2021-35944
7.5 - High
- September 29, 2021
Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.
Classic Buffer Overflow
Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow
CVE-2021-35945
7.5 - High
- September 29, 2021
Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.
Classic Buffer Overflow
An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2
CVE-2021-25643
4.9 - Medium
- May 26, 2021
An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or /listMetadataTokens call.
Cleartext Transmission of Sensitive Information
An issue was discovered in Couchbase Server 6.x through 6.6.1
CVE-2021-27924
5.9 - Medium
- May 19, 2021
An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session cookies in the logs. This allows for the impersonation of a user if the log files are obtained by an attacker before a session cookie expires.
Cleartext Transmission of Sensitive Information
An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1
CVE-2021-27925
4.4 - Medium
- May 19, 2021
An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condition can (depending on a race condition) cause an internal user with administrator privileges, @ns_server, to have its credentials leaked in cleartext in the ns_server.info.log file.
Race Condition
An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta
CVE-2021-25644
7.5 - High
- May 19, 2021
An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators.
Cleartext Storage of Sensitive Information
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions
CVE-2021-31158
6.5 - Medium
- May 19, 2021
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access.
AuthZ
An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1
CVE-2021-25645
4.4 - Medium
- May 10, 2021
An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past.
Cleartext Storage of Sensitive Information
Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack
CVE-2020-24719
9.8 - Critical
- November 12, 2020
Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0.
Shell injection
In Couchbase Server 6.0, credentials cached by a browser
CVE-2020-9042
8.8 - High
- June 08, 2020
In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request.
Session Riding
Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /settings REST endpoint exposed by the projector process is an endpoint
CVE-2020-9039
9.8 - Critical
- February 22, 2020
Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /settings REST endpoint exposed by the projector process is an endpoint that administrators can use for various tasks such as updating configuration and collecting performance profiles. The endpoint was unauthenticated and has been updated to only allow authenticated users to access these administrative APIs.
Incorrect Default Permissions
In Couchbase Server 5.0.0
CVE-2019-11497
7.5 - High
- September 10, 2019
In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it to establish future connections to the remote cluster. This has been fixed in version 5.5.0. XDCR now checks the validity of the certificate thoroughly and prevents a remote cluster reference from being created with an invalid certificate.
Improper Certificate Validation
In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket
CVE-2019-11496
9.1 - Critical
- September 10, 2019
In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets including "default" were changed to only allow access by authenticated users with sufficient authorization. However, users were allowed unauthenticated and unauthorized access to the "default" bucket if the properties of this bucket were edited. This has been fixed in versions 5.1.0 and 5.5.0.
Missing Authentication for Critical Function
In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely
CVE-2019-11495
9.8 - Critical
- September 10, 2019
In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now() to seed the PRNG which results in a small search space for potential random seeds that could then be used to brute force the cookie and execute code against a remote system. This has been fixed in version 6.0.0.
PRNG
In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson
CVE-2019-11467
7.5 - High
- September 10, 2019
In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like \t, <, >, it caused buffer overrun as encoded string would be much larger than accounted for, causing indexer service to crash and restart. This has been remedied in versions 5.1.2 and 5.5.2 to ensure buffer always grows as needed for any input.
Buffer Overflow
In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint
CVE-2019-11466
5.3 - Medium
- September 10, 2019
In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access.
Missing Authentication for Critical Function
An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0
CVE-2019-11465
5.3 - Medium
- September 10, 2019
An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The system information submitted to Couchbase as part of a bug report included the usernames for all users currently logged into the system even if the log was redacted for privacy. This has been fixed (in 5.5.4 and 6.0.1) so that usernames are tagged properly in the logs and are hashed out when the logs are redacted.
Side Channel Attack
Some enterprises require that REST API endpoints include security-related headers in REST responses
CVE-2019-11464
6.1 - Medium
- September 10, 2019
Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and X-XSS-Protection, which are more generally applicable to HTML endpoint, to be included too. These headers were not included in Couchbase Server 5.5.0 and 5.1.2 . They are now included in version 6.0.2 in responses from the Couchbase Server Views REST API (port 8092).
XSS
Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091
CVE-2018-15728
8.8 - High
- August 24, 2018
Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the underlying operating system with privileges of the user which was used to start Couchbase. Affects Version: 4.0.0, 4.1.2, 4.5.1, 5.0.0, 4.6.5, 5.0.1, 5.1.1, 5.5.0, 5.5.1. Fix Version: 6.0.0, 5.5.2
Code Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Couchbase Server or by Couchbase? Click the Watch button to subscribe.
