CVE-2020-24719
Critical
Description
Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0.
SeverityCritical
CVSS9.8
Exploit probability—
ProductCouchbase Server
PublishedNov 12, 2020
First seenNov 12, 2020
How to fix
Update
- couchbase couchbase_server6.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| couchbase couchbase_server | 6.5.1 ≤ v < 6.6.0 | 6.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.