CVE-2022-42950

An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service.

CVSS v3.0 4.9 MEDIUM

4.9^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://docs.couchbase.com/server/current/release-notes/relnotes.html	Release Notes
https://docs.couchbase.com/server/current/release-notes/relnotes.html	Release Notes
https://forums.couchbase.com/tags/security	Issue Tracking
https://forums.couchbase.com/tags/security	Issue Tracking
https://www.couchbase.com/alerts/	Vendor Advisory
https://www.couchbase.com/alerts/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:couchbase:couchbase_server::::::::
	cpe:2.3:a:couchbase:couchbase_server::::::::

History

26 Mar 2025, 15:15

Type	Values Removed	Values Added
References	~~(MISC) https://forums.couchbase.com/tags/security - Issue Tracking~~	() https://forums.couchbase.com/tags/security - Issue Tracking
References	~~(MISC) https://www.couchbase.com/alerts/ - Vendor Advisory~~	() https://www.couchbase.com/alerts/ - Vendor Advisory
References	~~(MISC) https://docs.couchbase.com/server/current/release-notes/relnotes.html - Release Notes~~	() https://docs.couchbase.com/server/current/release-notes/relnotes.html - Release Notes

Information

Published : 2023-02-06 21:15

Updated : 2025-03-26 15:15

NVD link : CVE-2022-42950

Mitre link : CVE-2022-42950

JSON object : View

Products Affected

couchbase

couchbase_server

CWE

NVD-CWE-noinfo

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://docs.couchbase.com/server/current/release-notes/relnotes.html", "name": "https://docs.couchbase.com/server/current/release-notes/relnotes.html", "tags": ["Release Notes"], "refsource": ""}, {"url": "https://docs.couchbase.com/server/current/release-notes/relnotes.html", "name": "https://docs.couchbase.com/server/current/release-notes/relnotes.html", "tags": ["Release Notes"], "refsource": ""}, {"url": "https://forums.couchbase.com/tags/security", "name": "https://forums.couchbase.com/tags/security", "tags": ["Issue Tracking"], "refsource": ""}, {"url": "https://forums.couchbase.com/tags/security", "name": "https://forums.couchbase.com/tags/security", "tags": ["Issue Tracking"], "refsource": ""}, {"url": "https://www.couchbase.com/alerts/", "name": "https://www.couchbase.com/alerts/", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://www.couchbase.com/alerts/", "name": "https://www.couchbase.com/alerts/", "tags": ["Vendor Advisory"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-42950", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}}, "publishedDate": "2023-02-06T21:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "7.0.5", "versionStartIncluding": "7.0.0"}, {"cpe23Uri": "cpe:2.3:a:couchbase:couchbase_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "7.1.2", "versionStartIncluding": "7.1.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-03-26T15:15Z"}