CVE-2019-11466: Medium severity wut com-server highspeed 100baselx vulnerability

Published Sep 10, 2019

Updated

In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access.

Affected Software

2 affected components

Couchbase Couchbase Server=5.5.0

Couchbase Couchbase Server=6.0.0

Event History

Sep 10, 2019

CVE Published

via MITRE·05:02 PM

Data Sourced

via MITRE·05:02 PM

Description

Frequently Asked Questions

What is CVE-2019-11466?

CVE-2019-11466 is a vulnerability in Couchbase Server 6.0.0 and 5.5.0 that exposes system diagnostic profile via an HTTP endpoint without requiring credentials.

How does CVE-2019-11466 affect Couchbase Server?

CVE-2019-11466 affects Couchbase Server 6.0.0 and 5.5.0, allowing unauthorized access to the system diagnostic profile over an insecure HTTP endpoint.

What is the severity of CVE-2019-11466?

The severity of CVE-2019-11466 is rated as medium with a CVSSv3 score of 5.3.

How can I fix CVE-2019-11466?

To fix CVE-2019-11466, upgrade to Couchbase Server version 6.0.1, which requires valid credentials to access the system diagnostic profile.

Where can I get more information about CVE-2019-11466?

More information about CVE-2019-11466 can be found at the following reference: [Couchbase Security Alerts](https://www.couchbase.com/resources/security#SecurityAlerts).