~ / search / GHSA-g622-r636-qfqh

GHSA-g622-r636-qfqh

SQL Injection in Couchbase Sync Gateway

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-9039

Packages

EcosystemPackageAffectedFixed in
Go github.com/couchbase/sync_gateway < 2.5.0 2.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

The Couchbase Sync Gateway 2.1.2 in combination with a Couchbase Server is affected by a previously undisclosed N1QL-injection vulnerability in the REST API. An attacker with access to the public REST API can insert additional N1QL statements through the parameters ?startkey? and ?endkey? of the ?_all_docs? endpoint.

References

External links from the advisory. They lead to third-party sites.