CVE-2025-49015

EPSS 0.03%
Veröffentlicht 18.06.2025 14:15:44
Zuletzt bearbeitet 09.07.2025 18:46:32
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 6

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Couchbase ≫ .Net Sdk Version <= 3.7.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.03%	0.082

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	4.9	1.2	3.6	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE-297 Improper Validation of Certificate with Host Mismatch

The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

https://docs.couchbase.com/server/current/release-notes/relnotes.html

Release Notes

https://forums.couchbase.com/tags/security

Issue Tracking

https://www.couchbase.com/alerts/

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-49015

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-49015

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-49015

EUVD