CS
Product
Couchbase Server
On CISA KEVExploited in the wild
63
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 32Medium 23Low 0
Watch
Add Couchbase Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-0519 In wildKEV | 8.8 | Jan 16 | Google Chromium V8 Out-of-Bounds Memory Access Vulnerability Affected: before 7.2.5 |
| CVE-2023-3079 In wildKEV | 8.8 | Jun 5 | Google Chromium V8 Type Confusion Vulnerability Affected: before 7.1.5; 7.2.0 |
| CVE-2023-2033 In wildKEV | 8.8 | Apr 14 | Google Chromium V8 Type Confusion Vulnerability Affected: before 7.1.5; 7.2.0 |
| CVE-2023-49931 | 9.8 | Feb 29 | An issue was discovered in Couchbase Server before 7.2.4 Affected: 5.0.0 before 7.2.4 |
| CVE-2023-49930 | 9.8 | Feb 29 | An issue was discovered in Couchbase Server before 7.2.4 Affected: 7.1.5 before 7.2.4 |
| CVE-2021-35943 | 9.8 | Sep 29 | Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control Affected: 6.5.0 through 6.5.2; 6.6.0 before 6.6.3 |
| CVE-2020-24719 | 9.8 | Nov 12 | Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack Affected: 6.5.1 before 6.6.0 |
| CVE-2020-9039 | 9.8 | Feb 22 | Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they… Affected: 4.6.0 through 4.6.5; 4.0.0; 4.1.0; 4.1.1; 4.5.0; 4.5.1; +4 more |
| CVE-2019-11495 | 9.8 | Sep 10 | In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely Affected: 5.1.1 |
| CVE-2022-32559 | 9.1 | Jun 14 | An issue was discovered in Couchbase Server before 7.0.4 Affected: 4.0.0 before 7.0.4 |
| CVE-2019-11496 | 9.1 | Sep 10 | In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication Affected: through 5.0.0 |
| CVE-2022-32562 | 8.8 | Jun 13 | An issue was discovered in Couchbase Server before 7.0.4 Affected: 7.0.0 through 7.0.4 |
| CVE-2020-9042 | 8.8 | Jun 8 | In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request Affected: 6.0.0 |
| CVE-2018-15728 | 8.8 | Aug 24 | Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091 Affected: All versions, or not specified |
| CVE-2023-50437 | 8.6 | Feb 29 | An issue was discovered in Couchbase Server before 7.2.x before 7.2.4 Affected: 2.0.0 before 7.2.4 |
| CVE-2022-42951 | 8.1 | Feb 6 | An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 Affected: 6.5.0 before 6.6.6; 7.0.0 before 7.0.5; 7.1.0 before 7.1.2 |
| CVE-2025-46619 | 7.6 | Apr 30 | A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files Affected: 2.0.0 before 7.2.7; 7.6.0 before 7.6.4 |
| CVE-2023-43768 | 7.5 | Mar 27 | An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1 Affected: 6.6.0 before 7.1.5; 7.2.0 |
| CVE-2024-23302 | 7.5 | Feb 29 | Couchbase Server before 7.2.4 has a private key leak in goxdcr.log Affected: before 7.2.4 |
| CVE-2023-49338 | 7.5 | Feb 28 | Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost Affected: 4.0.0 before 7.2.4 |
| CVE-2023-50782 | 7.5 | Feb 5 | A flaw was found in the python-cryptography package Affected: 7.6.0; 7.6.1 |
| CVE-2023-36667 | 7.5 | Nov 8 | Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal Affected: 2.0.0 before 7.1.5; 7.2.0 |
| CVE-2023-45875 | 7.5 | Nov 8 | An issue was discovered in Couchbase Server 7.2.0 Affected: 7.2.0 |
| CVE-2023-25016 | 7.5 | Feb 6 | Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor Affected: 2.0.0 before 6.6.6; 7.0.0 before 7.0.5; 7.1.0 before 7.1.2 |
| CVE-2022-32556 | 7.5 | Jul 21 | An issue was discovered in Couchbase Server before 7.0.4 Affected: 3.0.0 before 7.1.1 |
| CVE-2022-33173 | 7.5 | Jul 12 | An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4 Affected: 6.6.0 before 7.0.4 |
| CVE-2022-32557 | 7.5 | Jun 14 | An issue was discovered in Couchbase Server before 7.0.4 Affected: 4.0.0 before 7.0.4 |
| CVE-2022-32565 | 7.5 | Jun 13 | An issue was discovered in Couchbase Server before 7.0.4 Affected: 7.0.0 before 7.1.0 |
| CVE-2022-32192 | 7.5 | Jun 13 | Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor Affected: 5.0.0 before 7.0.4 |
| CVE-2022-32564 | 7.5 | Jun 13 | An issue was discovered in Couchbase Server before 7.0.4 Affected: before 7.0.4 |
| CVE-2022-32560 | 7.5 | Jun 13 | An issue was discovered in Couchbase Server before 7.0.4 Affected: 4.0.0 before 7.0.4 |
| CVE-2022-32558 | 7.5 | Jun 13 | An issue was discovered in Couchbase Server before 7.0.4 Affected: 6.6.0 through 6.6.3; 7.0.0; 7.0.1; 7.0.2; 7.0.3 |
| CVE-2021-42763 | 7.5 | Nov 2 | Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext Affected: before 4.6.0; 5.0.0 before 6.1.0; 6.5.0 through 6.6.2; 7.0.0; 7.0.1 |
| CVE-2021-37842 | 7.5 | Nov 2 | metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information Affected: 7.0.0; 7.0.1 |
| CVE-2021-35945 | 7.5 | Sep 29 | Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow Affected: 4.5.0 through 5.5.6; 6.0.0 through 6.0.5; 6.5.0 through 6.5.2; 6.6.0 through 6.6.2; 7.0.0 |
| CVE-2021-35944 | 7.5 | Sep 29 | Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow Affected: 6.5.0 through 6.5.2; 6.6.0 through 6.6.2; 7.0.0 |
| CVE-2021-25644 | 7.5 | May 19 | An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta Affected: 5.0.0 through 6.6.1; 7.0.0 |
| CVE-2020-9041 | 7.5 | Jun 8 | In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are vulnerable to the Slowloris… Affected: 6.0.3 |
| CVE-2019-11497 | 7.5 | Sep 10 | In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature Affected: 5.0.0 |
| CVE-2019-11467 | 7.5 | Sep 10 | In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson Affected: 4.6.3; 5.5.0 |
| CVE-2024-56178 | 6.5 | Jan 27 | An issue was discovered in Couchbase Server 7.6.x through 7.6.3 Affected: 7.6.0 through 7.6.3 |
| CVE-2023-45873 | 6.5 | Feb 28 | An issue was discovered in Couchbase Server through 7.2.2 Affected: before 7.2.3 |
| CVE-2022-32193 | 6.5 | Jun 13 | Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor Affected: 6.6.0 through 6.6.3; 7.0.0; 7.0.1; 7.0.2; 7.0.3 |
| CVE-2021-31158 | 6.5 | May 19 | In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to… Affected: 6.5.0 before 6.6.2 |
| CVE-2023-43769 | 6.3 | Feb 29 | An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1 Affected: 6.0.0 before 7.2.4 |
| CVE-2024-25673 | 6.1 | Sep 19 | Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection Affected: 2.0.0 before 7.2.6; 7.6.0 before 7.6.2 |
| CVE-2019-11464 | 6.1 | Sep 10 | Some enterprises require that REST API endpoints include security-related headers in REST responses Affected: 5.1.2; 5.5.0 |
| CVE-2024-37034 | 5.9 | Jul 26 | An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1 Affected: 6.0.0 before 7.2.5; 7.6.0 |
| CVE-2022-34826 | 5.9 | Jul 15 | In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs Affected: 7.1.0 |
| CVE-2021-27924 | 5.9 | May 19 | An issue was discovered in Couchbase Server 6.x through 6.6.1 Affected: 6.0.0 before 6.6.2 |