CVE-2022-24706

nvd nist nuclei

Published: Apr 26, 2022Modified: Jun 17, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Affected (1)

Products: Apache: Couchdb

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Couchdb	Before 3.2.2

Related CWEs

Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

References (21)

http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2022/04/26/1

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/05/09/1

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/05/09/2

Source: security@apache.org

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/05/09/3

Source: security@apache.org

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/05/09/4

Source: security@apache.org

Mailing ListPatchThird Party Advisory

https://docs.couchdb.org/en/3.2.2/setup/cluster.html

Source: security@apache.org

Broken LinkProduct

https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00

Source: security@apache.org

Mailing ListVendor Advisory

https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd

Source: security@apache.org

ExploitThird Party Advisory

http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2022/04/26/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/05/09/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/05/09/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/05/09/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/05/09/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

https://docs.couchdb.org/en/3.2.2/setup/cluster.html

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkProduct

https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.