ByteOS Network

NVD Vulnerability Details :

CVE-2018-15728

Modified

Source-cve@mitre.org

Published At-24 Aug, 2018 | 19:29

Updated At-26 Sep, 2019 | 19:15

Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the underlying operating system with privileges of the user which was used to start Couchbase. Affects Version: 4.0.0, 4.1.2, 4.5.1, 5.0.0, 4.6.5, 5.0.1, 5.1.1, 5.5.0, 5.5.1. Fix Version: 6.0.0, 5.5.2

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C

CPE Matches

Couchbase, Inc.

>>couchbase_server>>-

cpe:2.3:a:couchbase:couchbase_server:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-94	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://seclists.org/bugtraq/2018/Aug/49	cve@mitre.org	Exploit Mailing List Third Party Advisory
http://www.securityfocus.com/bid/105157	cve@mitre.org	Third Party Advisory VDB Entry
https://www.couchbase.com/resources/security#SecurityAlerts	cve@mitre.org	N/A

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History