CVE-2023-50437 - OpenCVE

An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://docs.couchbase.com/server/current/release-notes/relnotes.html
https://forums.couchbase.com/tags/security
https://www.couchbase.com/alerts/

History

Tue, 13 Aug 2024 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-266
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-02-28T00:00:00

Updated: 2024-08-13T19:34:51.095Z

Reserved: 2023-12-09T00:00:00

Link: CVE-2023-50437

Vulnrichment

Updated: 2024-08-02T22:16:46.366Z

NVD

Status : Awaiting Analysis

Published: 2024-02-29T01:42:00.750

Modified: 2024-08-13T20:35:01.850

Link: CVE-2023-50437

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-50437", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-13T19:34:51.095Z", "dateReserved": "2023-12-09T00:00:00", "datePublished": "2024-02-28T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-02-28T20:25:01.588648"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://forums.couchbase.com/tags/security"}, {"url": "https://docs.couchbase.com/server/current/release-notes/relnotes.html"}, {"url": "https://www.couchbase.com/alerts/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:46.366Z"}, "title": "CVE Program Container", "references": [{"url": "https://forums.couchbase.com/tags/security", "tags": ["x_transferred"]}, {"url": "https://docs.couchbase.com/server/current/release-notes/relnotes.html", "tags": ["x_transferred"]}, {"url": "https://www.couchbase.com/alerts/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "CWE-266 Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "couchbase", "product": "couchbase_server", "cpes": ["cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "7.2.0", "status": "affected", "lessThan": "7.2.4", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-13T19:28:19.948628Z", "id": "CVE-2023-50437", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T19:34:51.095Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://forums.couchbase.com/tags/security", "tags": ["x_transferred"]}, {"url": "https://docs.couchbase.com/server/current/release-notes/relnotes.html", "tags": ["x_transferred"]}, {"url": "https://www.couchbase.com/alerts/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:46.366Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-50437", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-13T19:28:19.948628Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*"], "vendor": "couchbase", "product": "couchbase_server", "versions": [{"status": "affected", "version": "7.2.0", "lessThan": "7.2.4", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "CWE-266 Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T19:34:46.540Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://forums.couchbase.com/tags/security"}, {"url": "https://docs.couchbase.com/server/current/release-notes/relnotes.html"}, {"url": "https://www.couchbase.com/alerts/"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-02-28T20:25:01.588648"}}}, "cveMetadata": {"cveId": "CVE-2023-50437", "state": "PUBLISHED", "dateUpdated": "2024-08-13T19:34:51.095Z", "dateReserved": "2023-12-09T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-02-28T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}