CVE-2022-24706: Apache CouchDB Insecure Default Initialization of Resource Vulnerability
First published: Tue Apr 26 2022(Updated: )
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache CouchDB | <3.2.2 | |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00
- http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2022/04/26/1
- http://www.openwall.com/lists/oss-security/2022/05/09/1
- http://www.openwall.com/lists/oss-security/2022/05/09/2
- http://www.openwall.com/lists/oss-security/2022/05/09/3
- http://www.openwall.com/lists/oss-security/2022/05/09/4
- https://docs.couchdb.org/en/3.2.2/setup/cluster.html
- https://medium.com/@_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd
Frequently Asked Questions
What is CVE-2022-24706?
CVE-2022-24706 is a vulnerability in Apache CouchDB that allows an attacker to access an improperly secured default installation without authenticating and gain admin privileges.
How severe is CVE-2022-24706?
CVE-2022-24706 has a severity rating of 9.8 (Critical).
How can an attacker exploit CVE-2022-24706?
CVE-2022-24706 can be exploited by an attacker to gain admin privileges in an improperly secured default installation of Apache CouchDB, without the need for authentication.
What are the affected software versions of CVE-2022-24706?
The affected software versions of CVE-2022-24706 are Apache CouchDB up to version 3.2.2.
How can I mitigate CVE-2022-24706?
To mitigate CVE-2022-24706, it is recommended to properly secure your Apache CouchDB installation by following the CouchDB documentation's recommendations, such as using a firewall.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- agent/weakness
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- collector/nvd-index
- vendor/apache
- canonical/apache couchdb