PT-2019-12336 · Couchbase · Couchbase Server

Published 2019-09-10 · Updated 2020-08-24 · CVE-2019-11496

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 5.1.0

Description The issue concerns unauthenticated and unauthorized access to the "default" bucket in Couchbase Server. Prior to version 5.0, the "default" bucket allowed read and write access without authentication. Although the behavior was changed in version 5.0 to require authentication, editing the properties of the "default" bucket could still allow unauthenticated access.

Recommendations For versions prior to 5.1.0, update to version 5.1.0 or 5.5.0 to fix the issue. As a temporary workaround, consider restricting access to the "default" bucket to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-11496

Affected Products

Couchbase Server

References · 3

• https://osv.dev/vulnerability/CVE-2019-11496 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11496 · Security Note
• https://couchbase.com/resources/security#SecurityAlerts · Vendor Advisory