CVE-2022-42951: couchbase couchbase_server Improper Authentication

Vulnerability summary

CVE-2022-42951 is a high (CVSS 8.1) Improper Authentication vulnerability in couchbase couchbase_server. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.5% of scored vulnerabilities.

Timeline

1. 06-02-2023
   PublishedVulnerability first disclosed.
2. 26-03-2025
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.