9.8Kritisch
KEV
CVE-2022-24706Remote Code Execution Vulnerability in Packaging
Bekannt ausgenutzt — Apache CouchDB Insecure Default Initialization of Resource Vulnerability
CISA hat am 25.08.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 15.09.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00; https://nvd.nist.gov/vuln/detail/CVE-2022-24706
Beschreibung
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
Schwachstellentyp (CWE):
CWE-1188
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Apache Software Foundation | Apache CouchDB | Apache CouchDB – ≤ 3.2.1 | |
| apache | couchdb | < 3.2.2 |
Referenzen und Patches
- https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00 Mailing ListVendor Advisory
- https://docs.couchdb.org/en/3.2.2/setup/cluster.html Broken LinkProduct
- [oss-security] 20220426 CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging mailing-listMailing ListThird Party Advisory
- [oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging mailing-listMailing ListThird Party Advisory
- [oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging mailing-listMailing ListPatchThird Party Advisory
- [oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging mailing-listMailing ListPatchThird Party Advisory
- [oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging mailing-listMailing ListPatchThird Party Advisory
- http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd ExploitThird Party Advisory
- http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706 US Government Resource
CPE-Treffer (NVD) (1)
cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*< 3.2.2