CVE-2019-11466

Severity CVSS v4.0:
Pending analysis
Type:
CWE-306 Missing Authentication for Critical Function
Publication date:
10/09/2019
Last modified:
24/08/2020

Description

In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:couchbase:couchbase_server:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:couchbase:couchbase_server:6.0.0:*:*:*:*:*:*:*


References to Advisories, Solutions, and Tools