CVE-2019-11465

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-10 · updated 2026-06-17
Weakness: CWE-532

Description

An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The system information submitted to Couchbase as part of a bug report included the usernames for all users currently logged into the system even if the log was redacted for privacy. This has been fixed (in 5.5.4 and 6.0.1) so that usernames are tagged properly in the logs and are hashed out when the logs are redacted.

Affected products

Couchbase Server: from 5.5.0 through 5.5.3; 6.0.0

References

https://www.couchbase.com/resources/security#SecurityAlerts
https://www.couchbase.com/resources/security#SecurityAlerts

Get alerted when CVE-2019-11465 or the next vulnerability affects your stack