PT-2018-13175 · Couchbase · Couchbase Server

Filip Palian · Publicado 2018-08-24 · Atualizado 2022-06-14 · CVE-2018-15728

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 4.0.0 through 5.5.1

Description The issue allows authenticated users with the 'Full Admin' role to execute arbitrary Erlang code on the underlying operating system with the privileges of the user running Couchbase. This is possible due to the exposure of the "/diag/eval" endpoint, which is available by default on TCP/8091 and/or TCP/18091.

Recommendations For versions 4.0.0 through 5.5.1, update to version 5.5.2 or 6.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the "/diag/eval" endpoint until a patch is applied.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2018-15728

Produtos afetados

Couchbase Server

Referências · 5

• 🔥 http://seclists.org/bugtraq/2018/Aug/49 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15728 · Nota de Segurança
• https://t.me/cibsecurity/44427 · Publicação no Telegram
• https://couchbase.com/resources/security#SecurityAlerts · Nota
• http://securityfocus.com/bid/105157 · Nota