Couchbase Server prior to 6.6.3 and 7.x prior to 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing the UI request.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
couchbase couchbase server |
||
couchbase couchbase server 7.0.0 |
||
couchbase couchbase server 7.0.1 |
Vulmon