CVE-2022-24706

Apache CouchDB Insecure Default Initialization of Resource

9.8 CRITICALActively exploited (CISA KEV)Public exploitEPSS 92.5%

Published26 Apr 2022
Added to CISA KEV25 Aug 2022
Remediation due15 Sept 2022

Description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Couchdb< 3.2.2

Remediation

Fixed in

Apache Couchdb≥ 3.2.2

Patch & vendor advisories

References

http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
https://docs.couchdb.org/en/3.2.2/setup/cluster.htmlBroken LinkProduct
https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00Mailing ListVendor Advisory
https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcdExploitThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706US Government Resource
http://www.openwall.com/lists/oss-security/2022/04/26/1Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2022/05/09/1Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2022/05/09/2Mailing ListPatchThird Party Advisory
http://www.openwall.com/lists/oss-security/2022/05/09/3Mailing ListPatchThird Party Advisory

and 1 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2022-24706 being actively exploited?

Yes. CVE-2022-24706 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 25 Aug 2022.

How severe is CVE-2022-24706?

CVE-2022-24706 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 92.5% probability of exploitation.

Which products are affected by CVE-2022-24706?

Affected products include Apache Couchdb.

How do I fix CVE-2022-24706?

Upgrade affected software to a fixed version, for example Apache Couchdb 3.2.2 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2022-24706 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.