PT-2021-23676 · Couchbase · Couchbase Server

Published 2021-11-02 · Updated 2021-11-08 · CVE-2021-42763

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 6.6.2 and earlier Couchbase Server versions 7.x prior to 7.0.2

Description The issue occurs when the cluster manager forwards an HTTP request from the pluggable UI to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request has the @ user credentials of the node processing the UI request. This results in sensitive information being stored in cleartext.

Recommendations For Couchbase Server versions 6.6.2 and earlier, update to version 6.6.3 or later. For Couchbase Server versions 7.x prior to 7.0.2, update to version 7.0.2 or later. As a temporary workaround, consider restricting access to the pluggable UI to minimize the risk of exploitation.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-42763

Affected Products

Couchbase Server

References · 6

• https://couchbase.com/alerts · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42763 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42763 · Vendor Advisory
• https://docs.couchbase.com/server/current/release-notes/relnotes.html · Vendor Advisory
• https://t.me/cibsecurity/31594 · Telegram Post
• https://t.me/cvenotify/22868 · Telegram Post