Vulnerability · Published Jun 10, 2022 · Assigned by mitre
CVE-2022-32563
Critical 9.8
In plain English
A critical-severity security flaw in the couchbase package (PyPI). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sync Gateway is configured to authenticate with Couchbase Server using X.509 client certificates, the admin credentials provided to the Admin REST API are ignored, resulting in privilege escalation for unauthenticated users. The Public REST API is not impacted by this issue. A workaround is to replace X.509 certificate based authentication with Username and Password authentication inside the bootstrap configuration.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | couchbase | 3.0.2 | GHSA-9266-j9v3-q4j5 |
| PyPI | couchbase | 3.0.2 | PYSEC-2022-207 |
Affected products (as reported)
References
- https://forums.couchbase.com/tags/security x_refsource_MISC
- https://www.couchbase.com/alerts x_refsource_MISC