Vulnerability Details CVE-2020-9040
Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer. An attacker can leverage this flaw by crafting a cryptographically valid certificate that will be accepted by Java SDK's Netty component due to missing hostname verification.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 34.8%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
Products affected by CVE-2020-9040
-
cpe:2.3:a:couchbase:couchbase_server_java_sdk:2.6
-
cpe:2.3:a:couchbase:couchbase_server_java_sdk:2.7