PT-2025-3199 · Couchbase · Couchbase Server

Published 2024-12-28 · Updated 2025-01-28 · CVE-2024-56178

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Couchbase Server versions 7.6.x through 7.6.3

Description An issue was discovered that allows a user with the security admin local role to create a new user in a group that has the admin role. This is related to incorrect permission storage. The issue can be exploited by a remote attacker to elevate their privileges.

Recommendations For Couchbase Server versions 7.6.x through 7.6.3, consider restricting the security admin local role to prevent unauthorized user creation in admin groups until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

BDU:2025-01239

CVE-2024-56178

Affected Products

Couchbase Server

References · 8

• https://couchbase.com/alerts · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56178 · Security Note
• https://bdu.fstec.ru/vul/2025-01239 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56178 · Vendor Advisory
• https://twitter.com/CVEnew/status/1884183347485892971 · Twitter Post
• https://t.me/cvedetector/16552 · Telegram Post
• https://vuldb.com/?id.293886 · Note
• https://t.me/cvenotify/108795 · Telegram Post