PT-2019-12324 · Couchbase · Couchbase Server

Publicado 2019-09-10 · Atualizado 2019-09-26 · CVE-2019-11464

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 5.1.2 through 5.5.0

Description The issue concerns the absence of certain security-related headers in REST responses from the Couchbase Server Views REST API. Specifically, headers such as X-Frame-Options, X-Content-Type-Options, X-Permitted-Cross-Domain-Policies, and X-XSS-Protection were not included. These headers are generally recommended for enhancing security.

Recommendations For Couchbase Server versions 5.1.2 through 5.5.0, update to version 6.0.2 or later to include the necessary security-related headers in responses from the Couchbase Server Views REST API.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-11464

Produtos afetados

Couchbase Server

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-11464 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11464 · Aviso do Fabricante
• https://couchbase.com/resources/security#SecurityAlerts · Aviso do Fabricante