CVE-2022-42950 Denial of service in n/a
An administrator can cause a denial of service in Couchbase Server Backup Service by sending a crafted HTTP request that exhausts memory.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-42950?
CVE-2022-42950 is a medium-severity denial of service vulnerability in Couchbase Couchbase Server, published on 6 Feb 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service.
Weakness: CWE-400
Which versions are affected by CVE-2022-42950?
It affects 1 product.
Products include Couchbase Couchbase Server.
How do I fix CVE-2022-42950?
No fix has been published for CVE-2022-42950 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-42950 being exploited?
There is no known exploitation of CVE-2022-42950 in the wild and no public exploit code.
Other vulnerabilities in Couchbase Couchbase Server
Sources
Also known as GHSA-xrvm-qcmp-42vc.