CVE-2021-37842

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published: Nov 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-378439.8The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e.CVE-2021-378453.7An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session during the cleartext ph CVE-2021-378477.5crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification.CVE-2021-378487.5common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.CVE-2021-37855.4yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-378505.5ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop t CVE-2021-378517.8Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer CVE-2021-378527.8ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privi CVE-2021-378596.1Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.CVE-2021-37865.5A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used CVE-2021-378606.1Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web CVE-2021-378617.5Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.