Vulnerability in Couchbase Server
CVE-2020-9039
Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /settings REST endpoint exposed by the projector process is an endpoint that administrators can use for various tasks such as updating configuration and collecting performance profiles. The endpoint was unauthenticated and has been updated to only allow authenticated users to access these administrative APIs.
EPSS: 0.039 (89.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Couchbase Couchbase_server — versions 4.0.0, 4.1.0, 4.1.1
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-9039?
- CVE-2020-9039 is a critical-severity vulnerability in Couchbase Server, classified under Incorrect Default Permissions. CVSS score: 9.8/10. Published 2020-02-22.
- How severe is CVE-2020-9039?
- Critical severity. CVSS v3 base score is 9.8 out of 10.