PT-2022-21904 · Couchbase · Couchbase Server

Published 2022-07-11 · Updated 2022-07-18 · CVE-2022-33911

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 7.0.4

Description An issue in Couchbase Server allows unauthorized actors to potentially obtain sensitive information due to field names not being redacted in logged validation messages for the Analytics Service.

Recommendations For versions prior to 7.0.4, update to version 7.0.4 or later to resolve the issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2022-33911

Affected Products

Couchbase Server

References · 5

• https://couchbase.com/alerts · Vendor Advisory
• https://docs.couchbase.com/server/current/release-notes/relnotes.html · Vendor Advisory
• https://forums.couchbase.com/tags/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-33911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33911 · Security Note