CVE-2020-9042: 
Couchbase vulnerability analysis and mitigation

CVE-2020-9042 affects Couchbase Server 6.0 and was disclosed on June 8, 2020. This vulnerability allows credentials cached by a browser to be used to perform a Cross-Site Request Forgery (CSRF) attack if an administrator has used their browser to check the results of a REST API request (NVD).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) issue (CWE-352). It has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that it can be exploited remotely with low attack complexity, requires user interaction, and can result in high impacts to confidentiality, integrity, and availability (NVD).

If successfully exploited, an attacker could potentially execute unauthorized actions on behalf of an authenticated administrator who has cached credentials in their browser. This could lead to complete compromise of system confidentiality, integrity, and availability through the administrator's privileges (NVD).

The vulnerability requires user interaction in the form of an administrator checking REST API request results in their browser, which would cache their credentials. The attack can then be executed remotely over the network with low complexity (NVD).

The vulnerability affects Couchbase Server version 6.0. Users should upgrade to a patched version of the software as recommended by Couchbase (Vendor Advisory).