CVE-2019-11497

{"id": "CVE-2019-11497", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-09-10T18:15:12.633", "references": [{"url": "https://www.couchbase.com/resources/security#SecurityAlerts", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it to establish future connections to the remote cluster. This has been fixed in version 5.5.0. XDCR now checks the validity of the certificate thoroughly and prevents a remote cluster reference from being created with an invalid certificate."}, {"lang": "es", "value": "En Couchbase Server versi\u00f3n 5.0.0, cuando se ingres\u00f3 un Certificado de cl\u00faster remoto no v\u00e1lido como parte de la creaci\u00f3n de referencia, XDCR no analiz\u00f3 ni verific\u00f3 la firma del certificado. Luego acept\u00f3 el certificado no v\u00e1lido e intent\u00f3 usarlo para establecer conexiones futuras al cl\u00faster remoto. Esto se ha solucionado en la versi\u00f3n 5.5.0. XDCR ahora verifica la validez del certificado a fondo y evita que se cree una referencia de cl\u00faster remoto con un certificado no v\u00e1lido."}], "lastModified": "2019-09-26T19:15:11.777", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:couchbase:couchbase_server:5.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2008B5F0-AE95-4F6D-89AD-451B7E2A0341"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}