Couchbase Server Open source NOSQL database

A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows

CVE-2025-46619 - April 30, 2025

A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files. Depending on the level of privileges, this vulnerability may grant access to files such as /etc/passwd or /etc/shadow.

An issue was discovered in Couchbase Server 7.6.x through 7.6.3

CVE-2024-56178 - January 27, 2025

An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group that has the admin role.

Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions

CVE-2024-25673 6.1 - Medium - September 19, 2024

Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection.

Injection

An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1

CVE-2024-37034 5.9 - Medium - July 26, 2024

An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) service using SCRAM-SHA when remote link encryption is configured for Half-Secure.

Inadequate Encryption Strength

An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1

CVE-2023-43768 - March 27, 2024

An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via large commands.

Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.

CVE-2024-23302 7.5 - High - February 29, 2024

Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.

An issue was discovered in Couchbase Server before 7.2.4

CVE-2023-50436 - February 29, 2024

An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the diag.log file. The earliest affected version is 7.1.5.

An issue was discovered in Couchbase Server before 7.2.x before 7.2.4

CVE-2023-50437 - February 29, 2024

An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2.

An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1

CVE-2023-43769 - February 29, 2024

An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed in Analytics.

An issue was discovered in Couchbase Server before 7.2.4

CVE-2023-49931 - February 29, 2024

An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted.

An issue was discovered in Couchbase Server before 7.2.4

CVE-2023-49932 - February 29, 2024

An issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL host restrictions.

An issue was discovered in Couchbase Server before 7.2.4

CVE-2023-49930 9.8 - Critical - February 29, 2024

An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted.

An issue was discovered in Couchbase Server through 7.2.2

CVE-2023-45874 4.3 - Medium - February 29, 2024

An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (outage of reader threads).

Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost.

CVE-2023-49338 - February 28, 2024

Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost.

An issue was discovered in Couchbase Server through 7.2.2

CVE-2023-45873 - February 28, 2024

An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exist) because of the OOM killer.

Allocation of Resources Without Limits or Throttling

A flaw was found in the python-cryptography package

CVE-2023-50782 7.5 - High - February 05, 2024

A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

Side Channel Attack

Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224

CVE-2024-0519 8.8 - High - January 16, 2024

Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Memory Corruption

Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1

CVE-2023-36667 7.5 - High - November 08, 2023

Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.

Directory traversal

An issue was discovered in Couchbase Server 7.2.0

CVE-2023-45875 7.5 - High - November 08, 2023

An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster.

Type confusion in V8 in Google Chrome prior to 114.0.5735.110

CVE-2023-3079 8.8 - High - June 05, 2023

Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Object Type Confusion

Type confusion in V8 in Google Chrome prior to 112.0.5615.121

CVE-2023-2033 8.8 - High - April 14, 2023

Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Object Type Confusion

In Couchbase Server 5 through 7 before 7.1.4

CVE-2023-28470 5.3 - Medium - March 23, 2023

In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication.

Missing Authentication for Critical Function

An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2

CVE-2022-42950 4.9 - Medium - February 06, 2023

An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service.

An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2

CVE-2022-42951 8.1 - High - February 06, 2023

An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials.

authentification

Couchbase Server before 6.6.6

CVE-2023-25016 7.5 - High - February 06, 2023

Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.

Cleartext Transmission of Sensitive Information

An issue was discovered in Couchbase Server before 7.0.4

CVE-2022-32556 7.5 - High - July 21, 2022

An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes.

Insertion of Sensitive Information into Log File

In Couchbase Server 7.1.x before 7.1.1

CVE-2022-34826 5.9 - Medium - July 15, 2022

In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.

Insertion of Sensitive Information into Log File

An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4

CVE-2022-33173 7.5 - High - July 12, 2022

An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. Analytics Remote Links may temporarily downgrade to non-TLS connection to determine the TLS port number, using SCRAM-SHA instead.

An issue was discovered in Couchbase Server 7.x before 7.0.4

CVE-2022-33911 5.3 - Medium - July 12, 2022

An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized Actor may be able to obtain Sensitive Information.

Insertion of Sensitive Information into Log File

An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4

CVE-2022-32561 4.9 - Medium - June 14, 2022

An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insufficient when it was discovered that diagnostic endpoints could still be accessed from the network.

An issue was discovered in Couchbase Server before 7.0.4

CVE-2022-32559 9.1 - Critical - June 14, 2022

An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics.

Allocation of Resources Without Limits or Throttling

An issue was discovered in Couchbase Server before 7.0.4

CVE-2022-32557 7.5 - High - June 14, 2022

An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers.

Missing Authentication for Critical Function

Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.

CVE-2022-32192 7.5 - High - June 13, 2022

Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.

Information Disclosure

An issue was discovered in Couchbase Server before 7.0.4

CVE-2022-32562 8.8 - High - June 13, 2022

An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission.

Incorrect Default Permissions

An issue was discovered in Couchbase Server before 7.0.4

CVE-2022-32565 7.5 - High - June 13, 2022

An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids.

Insertion of Sensitive Information into Log File

An issue was discovered in Couchbase Server before 7.0.4

CVE-2022-32564 7.5 - High - June 13, 2022

An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie.

Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.

CVE-2022-32193 6.5 - Medium - June 13, 2022

Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.

Insertion of Sensitive Information into Log File

An issue was discovered in Couchbase Server before 7.0.4

CVE-2022-32558 7.5 - High - June 13, 2022

An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal user passwords during a failure.

An issue was discovered in Couchbase Server before 7.0.4

CVE-2022-32560 7.5 - High - June 13, 2022

An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings.

AuthZ

Couchbase Server before 7.1.0 has Incorrect Access Control.

CVE-2021-33504 4.9 - Medium - June 02, 2022

Couchbase Server before 7.1.0 has Incorrect Access Control.

metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information

CVE-2021-37842 7.5 - High - November 02, 2021

metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it.

Cleartext Storage of Sensitive Information

Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext

CVE-2021-42763 7.5 - High - November 02, 2021

Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing the UI request.

Cleartext Storage of Sensitive Information

Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control

CVE-2021-35943 9.8 - Critical - September 29, 2021

Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC4513.

authentification

Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow

CVE-2021-35944 7.5 - High - September 29, 2021

Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.

Classic Buffer Overflow

Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow

CVE-2021-35945 7.5 - High - September 29, 2021

Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.

Classic Buffer Overflow

An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2

CVE-2021-25643 4.9 - Medium - May 26, 2021

An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or /listMetadataTokens call.

Cleartext Transmission of Sensitive Information

An issue was discovered in Couchbase Server 6.x through 6.6.1

CVE-2021-27924 5.9 - Medium - May 19, 2021

An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session cookies in the logs. This allows for the impersonation of a user if the log files are obtained by an attacker before a session cookie expires.

Cleartext Transmission of Sensitive Information

An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1

CVE-2021-27925 4.4 - Medium - May 19, 2021

An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condition can (depending on a race condition) cause an internal user with administrator privileges, @ns_server, to have its credentials leaked in cleartext in the ns_server.info.log file.

Race Condition

An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta

CVE-2021-25644 7.5 - High - May 19, 2021

An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators.

Cleartext Storage of Sensitive Information

In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions

CVE-2021-31158 6.5 - Medium - May 19, 2021

In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access.

AuthZ