Couchbase Couchbase_server
63 CVEs affecting Couchbase Couchbase_server. Latest disclosed: 2025-04-30. Critical: 8, High: 32.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49931 | Critical | 9.8 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted. |
CVE-2023-49930 | Critical | 9.8 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted. |
CVE-2021-35943 | Critical | 9.8 | 2021-09-29 | Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC45… |
CVE-2020-24719 | Critical | 9.8 | 2020-11-12 | Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic… |
CVE-2020-9039 | Critical | 9.8 | 2020-02-22 | Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer… |
CVE-2019-11495 | Critical | 9.8 | 2019-09-10 | In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now() to seed the PRNG which r… |
CVE-2022-32559 | Critical | 9.1 | 2022-06-14 | An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics. |
CVE-2019-11496 | Critical | 9.1 | 2019-09-10 | In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As par… |
CVE-2024-0519 | High | 8.8 | 2024-01-16 | Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2023-3079 | High | 8.8 | 2023-06-05 | Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-2033 | High | 8.8 | 2023-04-14 | Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2022-32562 | High | 8.8 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission. |
CVE-2020-9042 | High | 8.8 | 2020-06-08 | In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results o… |
CVE-2018-15728 | High | 8.8 | 2018-08-24 | Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role… |
CVE-2023-50437 | High | 8.6 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2. |
CVE-2022-42951 | High | 8.1 | 2023-02-06 | An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server n… |
CVE-2025-46619 | High | 7.6 | 2025-04-30 | A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sens… |
CVE-2023-43768 | High | 7.5 | 2024-03-27 | An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via lar… |
CVE-2024-23302 | High | 7.5 | 2024-02-29 | Couchbase Server before 7.2.4 has a private key leak in goxdcr.log. |
CVE-2023-49338 | High | 7.5 | 2024-02-28 | Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost. |