Details of VAR-202112-0358

ID

VAR-202112-0358

CVE

CVE-2021-43963

TITLE

Couchbase Sync Gateway Vulnerability regarding information leakage in

Trust: 0.8

sources: JVNDB: JVNDB-2021-016043

DESCRIPTION

An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Server were insecurely being stored in the metadata within sync documents written to the bucket. Users with read access could use these credentials to obtain write access. (This issue does not affect clusters where Sync Gateway is authenticated with X.509 client certificates. This issue also does not affect clusters where shared bucket access is not enabled on Sync Gateway.). Couchbase Sync Gateway There is a vulnerability related to information leakage.Information may be obtained and information may be tampered with. Couchbase Sync Gateway is a secure Web gateway for data access and data synchronization via the Web from Couchbase Corporation of the United States

Trust: 1.71

sources: NVD: CVE-2021-43963 // JVNDB: JVNDB-2021-016043 // VULHUB: VHN-406588

AFFECTED PRODUCTS

vendor:	couchbase	model:	sync gateway	scope:	gte	version:	2.7.0	Trust: 1.0
vendor:	couchbase	model:	sync gateway	scope:	lt	version:	2.8.3	Trust: 1.0
vendor:	couchbase	model:	sync gateway	scope:	eq	version:	-	Trust: 0.8
vendor:	couchbase	model:	sync gateway	scope:	eq	version:	2.7.0 to 2.8.2	Trust: 0.8

sources: JVNDB: JVNDB-2021-016043 // NVD: CVE-2021-43963

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-43963
value:	HIGH
Trust: 1.0
NVD:	CVE-2021-43963
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202112-521
value:	HIGH
Trust: 0.6
VULHUB:	VHN-406588
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-43963
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-406588
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-43963
baseSeverity:	HIGH
baseScore:	8.1
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	5.2
version:	3.1
Trust: 1.0
NVD:	CVE-2021-43963
baseSeverity:	HIGH
baseScore:	8.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-406588 // JVNDB: JVNDB-2021-016043 // CNNVD: CNNVD-202112-521 // NVD: CVE-2021-43963

PROBLEMTYPE DATA

problemtype:	CWE-200	Trust: 1.1
problemtype:	information leak (CWE-200) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-406588 // JVNDB: JVNDB-2021-016043 // NVD: CVE-2021-43963

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202112-521

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-202112-521

PATCH

title:	Enterprise Security Alerts	url:	https://www.couchbase.com/alerts	Trust: 0.8
title:	Couchbase Sync Gateway Repair measures for information disclosure vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=173868	Trust: 0.6

sources: JVNDB: JVNDB-2021-016043 // CNNVD: CNNVD-202112-521

EXTERNAL IDS

db:	NVD	id:	CVE-2021-43963	Trust: 3.3
db:	JVNDB	id:	JVNDB-2021-016043	Trust: 0.8
db:	CNNVD	id:	CNNVD-202112-521	Trust: 0.7
db:	VULHUB	id:	VHN-406588	Trust: 0.1

sources: VULHUB: VHN-406588 // JVNDB: JVNDB-2021-016043 // CNNVD: CNNVD-202112-521 // NVD: CVE-2021-43963

REFERENCES

url:	https://www.couchbase.com/alerts	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2021-43963	Trust: 1.4

sources: VULHUB: VHN-406588 // JVNDB: JVNDB-2021-016043 // CNNVD: CNNVD-202112-521 // NVD: CVE-2021-43963

SOURCES

db:	VULHUB	id:	VHN-406588
db:	JVNDB	id:	JVNDB-2021-016043
db:	CNNVD	id:	CNNVD-202112-521
db:	NVD	id:	CVE-2021-43963

LAST UPDATE DATE

2024-08-14T13:43:08.320000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-406588	date:	2021-12-09T00:00:00
db:	JVNDB	id:	JVNDB-2021-016043	date:	2022-12-05T07:28:00
db:	CNNVD	id:	CNNVD-202112-521	date:	2021-12-14T00:00:00
db:	NVD	id:	CVE-2021-43963	date:	2021-12-09T19:38:07.690

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-406588	date:	2021-12-07T00:00:00
db:	JVNDB	id:	JVNDB-2021-016043	date:	2022-12-05T00:00:00
db:	CNNVD	id:	CNNVD-202112-521	date:	2021-12-07T00:00:00
db:	NVD	id:	CVE-2021-43963	date:	2021-12-07T22:15:07.070