CVE-2023-50437: 
Couchbase vulnerability analysis and mitigation

An issue was discovered in Couchbase Server before 7.2.4 where the cluster's otpCookie was leaked to users with Full Admin role on API endpoint serverGroups and both Cluster Admin and Full Admin on API endpoint engageCluster2. This vulnerability could be used to elevate privileges (Couchbase Alerts).

The vulnerability, identified as CVE-2023-50437, has a CVSS score of 8.6 (High). The issue involves the exposure of the otpCookie to users with Full Admin role through the Cluster Manager's API endpoints serverGroups and engageCluster2. This cookie should remain protected as it can be used for privilege escalation (Couchbase Alerts).

The exposure of the otpCookie could allow attackers with Full Admin or Cluster Admin roles to potentially elevate their privileges beyond their intended permissions, potentially compromising cluster security (Couchbase Alerts).

The vulnerability requires an attacker to have either Full Admin or Cluster Admin role access to the system. The exploit can be triggered through specific API endpoints (serverGroups and engageCluster2) in the Cluster Manager (Couchbase Alerts).

The vulnerability has been patched in Couchbase Server version 7.2.4. Users running affected versions (Server 7.2.3, 7.2.2, 7.2.1, 7.2.0, 7.1.x, 7.0.x, 6.x, 5.x, 4.x, 3.x, 2.x) should upgrade to version 7.2.4 or later to address this security issue (Couchbase Alerts).