VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Sep 10, 2019· Updated Jun 17, 2026

CVE-2019-11466

CVE-2019-11466

Description

In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access.

Affected products

4
  • Couchbase/Server3 versions
    cpe:2.3:a:couchbase:couchbase_server:5.5.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:couchbase:couchbase_server:5.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:couchbase:couchbase_server:6.0.0:*:*:*:*:*:*:*
    • (no CPE)range: 6.0.0, 5.5.0
  • Couchbase/Couchbase Serverdescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.