CVE-2021-37842 Information disclosure in n/a
Remote Cluster XDCR credentials are leaked in debug logs when config key tombstone purging is active, exposing sensitive information to attackers with log access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-37842?
CVE-2021-37842 is a high-severity vulnerability in Couchbase Couchbase Server, published on 2 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it.
Weakness: CWE-312
Which versions are affected by CVE-2021-37842?
It affects 1 product.
Products include Couchbase Couchbase Server.
How do I fix CVE-2021-37842?
No fix has been published for CVE-2021-37842 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-37842 being exploited?
There is no known exploitation of CVE-2021-37842 in the wild and no public exploit code.
Other vulnerabilities in Couchbase Couchbase Server
Sources
Also known as GHSA-8w77-53f9-9p5h.