Skip to main content

Couchbase Server CVE-2022-32559

CRITICAL
Allocation of Resources Without Limits or Throttling (CWE-770)
2022-06-14 cve@mitre.org
9.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 14, 2022 - 17:15 nvd
CRITICAL 9.1

DescriptionNVD

An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics.

AnalysisAI

An issue was discovered in Couchbase Server before 7.0.4. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Allocation of Resources Without Limits (CWE-770), which allows attackers to exhaust system resources through uncontrolled allocation. An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics. Affected products include: Couchbase Couchbase Server. Version information: before 7.0.4..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Set resource limits, implement rate limiting, validate input sizes.

CVE-2020-24719 CRITICAL POC
9.8 Nov 12

Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Rated critical severity (CVSS 9.8), this vuln

CVE-2020-9039 CRITICAL POC
9.8 Feb 22

Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Per

CVE-2023-3079 HIGH POC
8.8 Jun 05

Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corr

CVE-2018-15728 HIGH POC
8.8 Aug 24

Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Rated hig

CVE-2021-35943 CRITICAL
9.8 Sep 29

Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Rated critical severity (CVSS 9.8), this vu

CVE-2019-11495 CRITICAL
9.8 Sep 10

In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Rated critical sever

CVE-2019-11496 CRITICAL
9.1 Sep 10

In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and writ

CVE-2023-2033 HIGH
8.8 Apr 14

Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corr

CVE-2022-32562 HIGH
8.8 Jun 13

An issue was discovered in Couchbase Server before 7.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely

CVE-2020-9042 HIGH
8.8 Jun 08

In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has us

CVE-2023-50782 HIGH
7.5 Feb 05

A flaw was found in the python-cryptography package. Rated high severity (CVSS 7.5), this vulnerability is remotely expl

CVE-2025-46619 HIGH
7.6 Apr 30

A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that

Share

CVE-2022-32559 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy