CVE-2021-25643

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or /listMetadataTokens call.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
May 26, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-256447.5An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leakeCVE-2021-256454.4An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with adCVE-2021-256468.8Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is inteCVE-2021-256475.4Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it toCVE-2021-256489.8Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features CVE-2021-256495.5An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerabiliCVE-2021-256508.8A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute speciaCVE-2021-256517.8A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate priviCVE-2021-256525.5An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform CVE-2021-256537.8A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) that may potentially alCVE-2021-256547.8An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute spCVE-2021-256556.1A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through