CVE-2019-11496

{"id": "CVE-2019-11496", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2019-09-10T18:15:12.557", "references": [{"url": "https://www.couchbase.com/resources/security#SecurityAlerts", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "In versions of Couchbase Server prior to 5.0, the bucket named \"default\" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets including \"default\" were changed to only allow access by authenticated users with sufficient authorization. However, users were allowed unauthenticated and unauthorized access to the \"default\" bucket if the properties of this bucket were edited. This has been fixed in versions 5.1.0 and 5.5.0."}, {"lang": "es", "value": "En las versiones de Couchbase Server anteriores a la version 5.0, el dep\u00f3sito denominado \"predeterminado\" era un dep\u00f3sito especial que permit\u00eda el acceso de lectura y escritura sin autenticaci\u00f3n. Como parte de 5.0, el comportamiento de todos los dep\u00f3sitos, incluido el \"predeterminado\", se modific\u00f3 para permitir solo el acceso de usuarios autenticados con autorizaci\u00f3n suficiente. Sin embargo, a los usuarios se les permit\u00eda el acceso no autenticado y no autorizado al dep\u00f3sito \"predeterminado\" si se editaban las propiedades de este dep\u00f3sito. Esto se ha solucionado en las versiones 5.1.0 y 5.5.0."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FACC4DE4-23B1-4249-B5F6-C752DBF6B04F", "versionEndIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}