CVE-2021-37842

HIGH

Couchbase Server 7.0.0 - Cleartext Storage of Sensitive Information in Debug Logs

Title source: llm
STIX 2.1

Description

metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it.

References (2)

Core 2
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://docs.couchbase.com/server/current/release-notes/relnotes.html
Vendor Advisory x_refsource_misc
https://www.couchbase.com/alerts

Scores

CVSS v3 7.5
EPSS 0.0059
EPSS Percentile 43.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-312
Status published
Products (2)
couchbase/couchbase_server 7.0.0
couchbase/couchbase_server 7.0.1
Published Nov 02, 2021
Tracked Since Feb 18, 2026