couchbase couchbase server 5.5.0 vulnerabilities and exploits

(subscribe to this query)

5.3

CVSSv3

In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access.

Couchbase Couchbase Server 5.5.0 Couchbase Couchbase Server 6.0.0

6.1

CVSSv3

Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-...

Couchbase Couchbase Server 5.5.0 Couchbase Couchbase Server 5.1.2

7.5

CVSSv3

In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like \t, <, >, it caused buffer overrun as encoded string would be much larger than accounted for, causing indexer serv...

Couchbase Couchbase Server 5.5.0 Couchbase Couchbase Server 4.6.3

9.8

CVSSv3

Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 up to and including 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /settings REST endpoint exposed by the projector proce...

Couchbase Couchbase Server 4.0.0 Couchbase Couchbase Server 4.1.0 Couchbase Couchbase Server 4.1.1 Couchbase Couchbase Server 4.5.0 Couchbase Couchbase Server 4.5.1 Couchbase Couchbase Server Couchbase Couchbase Server 5.0.0 Couchbase Couchbase Server 5.1.1 Couchbase Couchbase Server 5.5.0 Couchbase Couchbase Server 5.5.1

9.1

CVSSv3

In versions of Couchbase Server before 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets including "default" were changed to only allow access by authenti...

Couchbase Couchbase Server

8.8

CVSSv3

Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the co...

Couchbase Couchbase Server -

7.5

CVSSv3

In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it to establish future connections to the rem...

Couchbase Couchbase Server 5.0.0

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook