CVE-2021-27925: couchbase couchbase_server Race Condition

Vulnerability summary

CVE-2021-27925 is a medium (CVSS 4.4) Race Condition vulnerability in couchbase couchbase_server. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.5% of scored vulnerabilities.

Timeline

1. 19-05-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condition can (depending on a race condition) cause an internal user with administrator privileges, @ns_server, to have its credentials leaked in cleartext in the ns_server.info.log file.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.