CVE-2020-9039

Description

Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /settings REST endpoint exposed by the projector process is an endpoint that administrators can use for various tasks such as updating configuration and collecting performance profiles. The endpoint was unauthenticated and has been updated to only allow authenticated users to access these administrative APIs.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

66.106

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2019-14863,CVE-2020-9039 are fixed in Couchbase Server Enterprise Edition 6.5.0	Windows
Vulnerabilities CVE-2020-9039,CVE-2018-15728,CVE-2019-11495 are fixed in Couchbase Server Enterprise Edition 6.0.0	Windows
Vulnerabilities CVE-2020-9039,CVE-2018-15728,CVE-2019-11467 are fixed in Couchbase Server Enterprise Edition 5.5.2	Windows
Vulnerabilities CVE-2020-9039,CVE-2019-11467 are fixed in Couchbase Server Enterprise Edition 5.1.2	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234