VulnerabilityModified
CVE-2021-31158
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access.
MEDIUM 6.5EPSS 0.70%
Does this matter?
Lower severity and a low EPSS score (0.70%). Track it; it rarely justifies an emergency change on its own.
Description
In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.70% probability · 51th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Affected
- couchbase/couchbase server
- Source
- cve@mitre.org
References
- https://docs.couchbase.com/server/current/release-notes/relnotes.htmlRelease Notes, Vendor Advisory
- https://www.couchbase.com/resources/security#SecurityAlertsVendor Advisory
- https://docs.couchbase.com/server/current/release-notes/relnotes.htmlRelease Notes, Vendor Advisory
- https://www.couchbase.com/resources/security#SecurityAlertsVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.