CVE-2024-23302: 
Couchbase vulnerability analysis and mitigation

Couchbase Server before version 7.2.4 contains a vulnerability where the private key used for Cross Datacenter Replication (XDCR) was leaked in the goxdcr.log file (Couchbase Alerts, NVD). The vulnerability was discovered and disclosed in January 2024, affecting multiple versions of Couchbase Server from 4.5.x through 7.2.3.

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue stems from improper handling of sensitive information, specifically the XDCR private key being written to the goxdcr.log file (NVD).

The exposure of the private key in the log file could potentially allow attackers who gain access to the logs to compromise the security of Cross Datacenter Replication communications. This vulnerability has been classified as having a Low (2.1) severity impact according to Couchbase's security assessment (Couchbase Alerts).

While the vulnerability requires access to the log files to be exploited, it affects a wide range of Couchbase Server versions including 7.2.3, 7.2.2, 7.2.1, 7.2.0, 7.1.x, 7.0.x, 6.x, 5.x, and 4.5.x (Couchbase Alerts).

The vulnerability has been fixed in Couchbase Server version 7.2.4. Users are advised to upgrade to this version to address the security issue (Couchbase Alerts).