CVE-2021-25645
First published: Mon May 10 2021(Updated: )
An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Couchbase Couchbase Server | <6.0.5 | |
| Couchbase Couchbase Server | >=6.1.0<6.5.2 | |
| Couchbase Couchbase Server | >=6.6.0<6.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-25645?
CVE-2021-25645 is a vulnerability discovered in Couchbase Server before version 6.0.5, 6.1.x through 6.5.x before version 6.5.2, and 6.6.x before version 6.6.1.
What is the severity of CVE-2021-25645?
CVE-2021-25645 has a severity rating of 4.4 (medium).
Which software versions are affected by CVE-2021-25645?
Couchbase Server versions before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1 are affected by CVE-2021-25645.
How can an internal user with administrator privileges leak credentials in Couchbase Server?
An internal user with administrator privileges, @ns_server, can leak credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files in Couchbase Server.
How can I fix CVE-2021-25645?
To fix CVE-2021-25645, it is recommended to upgrade to Couchbase Server version 6.0.5 or later, 6.1.0 or later, 6.5.2 or later, or 6.6.1 or later.
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/author
- agent/references
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/couchbase
- canonical/couchbase couchbase server
- version/couchbase couchbase server/6.1.0
- version/couchbase couchbase server/6.6.0