PT-2021-16721 · Couchbase · Couchbase Server

Published 2021-05-26 · Updated 2021-09-09 · CVE-2021-25643

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 5.x through 6.5.1 Couchbase Server versions 6.6.x through 6.6.1

Description An issue was discovered where internal users with administrator privileges, such as @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file. This occurs when these users make a call to certain API endpoints, including "/listCreateTokens", "/listRebalanceTokens", or "/listMetadataTokens".

Recommendations For Couchbase Server versions 5.x through 6.5.1, update to version 6.5.2 or later. For Couchbase Server versions 6.6.x through 6.6.1, update to version 6.6.2 or later.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2021-25643

Affected Products

Couchbase Server

References · 3

• https://osv.dev/vulnerability/CVE-2021-25643 · Vendor Advisory
• https://couchbase.com/resources/security#SecurityAlerts · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25643 · Security Note