CVE-2021-25645: Medium severity wut com-server highspeed 100baselx vulnerability
An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @nsserver, leaks credentials in cleartext in the cbcollectinfo.log, debug.log, nscouchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-25645?
CVE-2021-25645 is a vulnerability discovered in Couchbase Server before version 6.0.5, 6.1.x through 6.5.x before version 6.5.2, and 6.6.x before version 6.6.1.
What is the severity of CVE-2021-25645?
CVE-2021-25645 has a severity rating of 4.4 (medium).
Which software versions are affected by CVE-2021-25645?
Couchbase Server versions before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1 are affected by CVE-2021-25645.
How can an internal user with administrator privileges leak credentials in Couchbase Server?
An internal user with administrator privileges, @ns_server, can leak credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files in Couchbase Server.
How can I fix CVE-2021-25645?
To fix CVE-2021-25645, it is recommended to upgrade to Couchbase Server version 6.0.5 or later, 6.1.0 or later, 6.5.2 or later, or 6.6.1 or later.