CVE-2023-49930: 
Couchbase vulnerability analysis and mitigation

A vulnerability was discovered in Couchbase Server before version 7.2.4, identified as CVE-2023-49930. The issue involves insufficient restrictions on cURL calls to /diag/eval through the Eventing Service. This vulnerability was disclosed and fixed in January 2024, affecting Couchbase Server versions 7.2.3, 7.2.2, 7.2.1, 7.2.0, 7.1.x, 7.0.x, and 6.5.x (Couchbase Alerts).

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 CRITICAL with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue specifically involves calling cURL via SQL++ (N1QL) through the Eventing Service to the localhost's /diag/eval endpoint, which wasn't fully prevented (NVD).

The vulnerability is rated as High (8.6) severity and could potentially allow attackers to execute unauthorized commands through the Eventing Service, potentially compromising system security (Couchbase Alerts).

The vulnerability can be exploited through cURL calls to the /diag/eval endpoint via the Eventing Service, with insufficient restrictions in place. This makes the system potentially vulnerable to unauthorized access and command execution (NVD).

The vulnerability has been patched in Couchbase Server version 7.2.4. Users are strongly advised to upgrade to this version or later to address the security issue. The fix implements proper restrictions on cURL calls to the /diag/eval endpoint through the Eventing Service (Couchbase Alerts).