Описание
In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:couchbase:couchbase_server:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:couchbase:couchbase_server:6.0.0:*:*:*:*:*:*:*
EPSS
Процентиль: 54%
0.00311
Низкий
5.3 Medium
CVSS3
5 Medium
CVSS2
Дефекты
CWE-306
Связанные уязвимости
github
больше 3 лет назад
An issue was discovered in Couchbase Server 5.5.0 and 6.0.0. The Eventing debug endpoint mishandles authentication and audit.
EPSS
Процентиль: 54%
0.00311
Низкий
5.3 Medium
CVSS3
5 Medium
CVSS2
Дефекты
CWE-306