Vulnerability Details : CVE-2021-42763

Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing the UI request.

Published 2021-11-02 12:15:08

Updated 2021-11-08 14:59:22

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-42763

Probability of exploitation activity in the next 30 days: 0.16%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 51 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2021-42763

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	[email protected]
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	[email protected]
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2021-42763

CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Assigned by: [email protected] (Primary)

References for CVE-2021-42763

https://www.couchbase.com/alerts

Vendor Advisory

CVEs referencing this url
https://docs.couchbase.com/server/current/release-notes/relnotes.html

Release Notes;Vendor Advisory

CVEs referencing this url

Products affected by CVE-2021-42763

Couchbase » Couchbase Server
Versions from including (>=) 5.0.0 and before (<) 6.1.0
cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*
Matching versions
Couchbase » Couchbase Server
Versions before (<) 4.6.0
cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*
Matching versions
Couchbase » Couchbase Server
Versions from including (>=) 6.5.0 and up to, including, (<=) 6.6.2
cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*
Matching versions
Couchbase » Couchbase Server » Version: 7.0.0
cpe:2.3:a:couchbase:couchbase_server:7.0.0:-:*:*:*:*:*:*
Matching versions
Couchbase » Couchbase Server » Version: 7.0.1
cpe:2.3:a:couchbase:couchbase_server:7.0.1:*:*:*:*:*:*:*
Matching versions