CVE-2020-9039
CriticalCouchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /settings REST endpoint exposed by the projector process is an…
Published Feb 21, 2020 · Updated Nov 21, 2024
Key Facts
Patch in the next maintenance window- CVE-2020-9039 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Couchbase Server.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 3.9% probability of exploitation in the next 30 days.
- Fixed versions are available, including Couchbase Server <=4.6.5, Couchbase Server 4.6.5.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
3.9%
Higher than 90.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2020-9039 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /settings REST endpoint exposed by the projector process is an endpoint that administrators can use for various tasks such as updating configuration and collecting performance profiles. The endpoint was unauthenticated and has been updated to only allow authenticated users to access these administrative APIs.
Affected Products
10 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Couchbase ServerCouchbase | 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 5.0.0, 5.1.1, 5.5.0 | 4.6.5 |
Patched Releases
Couchbase Server
<=4.6.5
Timeline
Publicly disclosed
Feb 21, 2020
Last updated
Nov 21, 2024
Weakness Type
- CWE-276 Incorrect Default Permissions
References
FAQ
Common Questions.
Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /settings REST endpoint exposed by the projector process is an endpoint that administrators can use for v…
Affected: Couchbase Server versions 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 5.0.0, 5.1.1, 5.5.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Couchbase Server <=4.6.5, Couchbase Server 4.6.5.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2020-9039 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo