PT-2019-12336 · Couchbase · Couchbase Server

Publicado 2019-09-10 · Atualizado 2020-08-24 · CVE-2019-11496

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 5.1.0

Description The issue concerns unauthenticated and unauthorized access to the "default" bucket in Couchbase Server. Prior to version 5.0, the "default" bucket allowed read and write access without authentication. Although the behavior was changed in version 5.0 to require authentication, editing the properties of the "default" bucket could still allow unauthenticated access.

Recommendations For versions prior to 5.1.0, update to version 5.1.0 or 5.5.0 to fix the issue. As a temporary workaround, consider restricting access to the "default" bucket to minimize the risk of exploitation.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-11496

Produtos afetados

Couchbase Server

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-11496 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11496 · Nota de Segurança
• https://couchbase.com/resources/security#SecurityAlerts · Aviso do Fabricante