CVE-2023-49930

The /diag/eval endpoint in Couchbase Server enables execution of diagnostic code on the server. Due to insufficient restrictions on cURL calls directed to this endpoint, an attacker can send network requests without proper authentication or authorization. The vulnerability is classified as an access control issue (CWE-284), meaning that authorization verification mechanisms do not work as intended by security assumptions.

An attacker without any authentication, remotely over the network, can gain full control over the confidentiality, integrity, and availability of the system — corresponding to maximum CVSS scores in these categories.

Couchbase Server should be updated to version 7.2.4 or newer. Detailed information is available in the official release notes from the vendor at docs.couchbase.com and on the security alerts page at couchbase.com/alerts/

Couchbase Server in all versions before 7.2.4