CVE-2021-31158
First published: Wed May 19 2021(Updated: )
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Couchbase Couchbase Server | >=6.5.0<6.6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2021-31158.
What is the title of this vulnerability?
The title of this vulnerability is 'In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1 Common Table Expression queries not correctly checking user's permissions'.
What is the description of this vulnerability?
The description of this vulnerability is 'Common Table Expression queries in Couchbase Server 6.5.x and 6.6.x through 6.6.1 did not correctly check the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access'.
What software versions are affected by this vulnerability?
Couchbase Server versions 6.5.x and 6.6.x through 6.6.1 are affected by this vulnerability.
What is the severity of CVE-2021-31158?
The severity of CVE-2021-31158 is medium with a severity value of 6.5.
How can I fix the vulnerability identified as CVE-2021-31158?
To fix the vulnerability identified as CVE-2021-31158, you should update Couchbase Server to version 6.6.2 or later, as this vulnerability has been fixed in that version.
Are there any references available for more information about this vulnerability?
Yes, you can find more information about this vulnerability at the following references: [1] [2]
What is the CWE ID associated with this vulnerability?
The CWE ID associated with this vulnerability is CWE-863.
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/event
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/couchbase
- canonical/couchbase couchbase server
- version/couchbase couchbase server/6.5.0