CVE-2019-11495 describes a critical vulnerability in Couchbase Server versions prior to 6.0.0, where the intra-node communication cookie was insecurely generated using a predictable pseudo-random number generator. This flaw allows an unauthenticated remote attacker to brute force the cookie, leading to arbitrary code execution with a CVSS score of 9.8. While no public exploit code or active exploitation has been observed, the vulnerability's ease of exploitation and severe impact warrant immediate patching. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.1.1CPE matchmatch criteria | cpe:2.3:a:couchbase:couchbase_server:5.1.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.