CVE-2018-15728

Name: CVE-2018-15728
Creator: NVD / NIST
Published: 2018-08-24T19:29:02.157+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.92%

Last modified Jun 17, 2026

CVE-2018-15728 is a vulnerability of currently unknown severity. Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the underlying operating system with privileges of the user which was used to start Couchbase. EPSS estimates a 2.92% chance of exploitation in the next 30 days.

Description

Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the underlying operating system with privileges of the user which was used to start Couchbase. Affects Version: 4.0.0, 4.1.2, 4.5.1, 5.0.0, 4.6.5, 5.0.1, 5.1.1, 5.5.0, 5.5.1. Fix Version: 6.0.0, 5.5.2

Metrics

EPSS Probability

2.92%

85.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-94

Affected Software

Vendor	Product	Versions
Couchbase	Couchbase Server	All versions

References

http://seclists.org/bugtraq/2018/Aug/49Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/105157Third Party Advisory, VDB Entry
https://www.couchbase.com/resources/security#SecurityAlerts
http://seclists.org/bugtraq/2018/Aug/49Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/105157Third Party Advisory, VDB Entry
https://www.couchbase.com/resources/security#SecurityAlerts

Timeline

Published: Aug 24, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-15728?

How severe is CVE-2018-15728?

Severity scoring for CVE-2018-15728 is pending analysis. The EPSS model estimates a 2.92% probability of exploitation in the next 30 days.

How do I fix CVE-2018-15728?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-15728?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST