CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-11466
https://notcve.org/view.php?id=CVE-2019-11466
In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access. En Couchbase Server versiones 6.0.0 y 5.5.0, el servicio de eventos expone el perfil de diagnóstico del sistema a través de un punto final HTTP que no requiere credenciales en un puerto destinado solo para tráfico interno. Esto se solucionó en la versión 6.0.1 y ahora requiere credenciales válidas para acceder. • https://www.couchbase.com/resources/security#SecurityAlerts • CWE-306: Missing Authentication for Critical Function •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-11465
https://notcve.org/view.php?id=CVE-2019-11465
An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The system information submitted to Couchbase as part of a bug report included the usernames for all users currently logged into the system even if the log was redacted for privacy. This has been fixed (in 5.5.4 and 6.0.1) so that usernames are tagged properly in the logs and are hashed out when the logs are redacted. Se detectó un problema en Couchbase Server versiones 5.5.x hasta 5.5.3 y versión 6.0.0. • https://www.couchbase.com/resources/security#SecurityAlerts • CWE-532: Insertion of Sensitive Information into Log File •