GHSA-g622-r636-qfqh

Source

https://github.com/advisories/GHSA-g622-r636-qfqh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-g622-r636-qfqh/GHSA-g622-r636-qfqh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g622-r636-qfqh

Aliases

CVE-2019-9039

Published

2022-02-15T01:57:18Z

Modified

2023-11-08T04:01:46.370526Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

SQL Injection in Couchbase Sync Gateway

Details

The Couchbase Sync Gateway 2.1.2 in combination with a Couchbase Server is affected by a previously undisclosed N1QL-injection vulnerability in the REST API. An attacker with access to the public REST API can insert additional N1QL statements through the parameters ?startkey? and ?endkey? of the ?alldocs? endpoint.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-17T16:33:43Z",
    "nvd_published_at": null,
    "severity": "CRITICAL",
    "cwe_ids": [
        "CWE-89"
    ]
}

References

Affected packages

Go / github.com/couchbase/sync_gateway

Package

Name: github.com/couchbase/sync_gateway; View open source insights on deps.dev
Purl: pkg:golang/github.com/couchbase/sync_gateway

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.5.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-g622-r636-qfqh/GHSA-g622-r636-qfqh.json"