GitHub Advisoryadvisory · PyPI

GHSA-9266-j9v3-q4j5 Couchbase Sync Gateway admin credentials not verified when using X.509 client cert authentication

CRITICAL Published 2022-06-11 Modified 2024-09-13 Official page ↗
Aliases
CVE-2022-32563
Ecosystem
PyPI
Packages
couchbase
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-295
Reviewed
2024-04-24

Affected packages

• PyPI couchbase: >= 3.0.0, < 3.0.2 → fixed in 3.0.2

Description

An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sync Gateway is configured to authenticate with Couchbase Server using X.509 client certificates, the admin credentials provided to the Admin REST API are ignored, resulting in privilege escalation for unauthenticated users. The Public REST API is not impacted by this issue. A workaround is to replace X.509 certificate based authentication with Username and Password authentication inside the bootstrap configuration.

Related

Alias · CVE (1)

  • CVE-2022-32563 An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References