Vulnerability · Published Nov 12, 2020 · Assigned by mitre
CVE-2020-24719
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 23.3% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Official description
Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0.
Affected products (as reported)
References
- https://www.couchbase.com/resources/security#VulnerabilityReporting x_refsource_CONFIRM