9.8Critical
KEV
CVE-2022-24706Remote Code Execution Vulnerability in Packaging
Known exploited — Apache CouchDB Insecure Default Initialization of Resource Vulnerability
CISA confirmed this vulnerability is used in real attacks on 25.08.2022. Remediation deadline for US federal agencies: 15.09.2022.
Required action: Apply updates per vendor instructions. https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00; https://nvd.nist.gov/vuln/detail/CVE-2022-24706
Description
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
Weakness (CWE):
CWE-1188
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Apache Software Foundation | Apache CouchDB | Apache CouchDB – ≤ 3.2.1 | |
| apache | couchdb | < 3.2.2 |
References and patches
- https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00 Mailing ListVendor Advisory
- https://docs.couchdb.org/en/3.2.2/setup/cluster.html Broken LinkProduct
- [oss-security] 20220426 CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging mailing-listMailing ListThird Party Advisory
- [oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging mailing-listMailing ListThird Party Advisory
- [oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging mailing-listMailing ListPatchThird Party Advisory
- [oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging mailing-listMailing ListPatchThird Party Advisory
- [oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging mailing-listMailing ListPatchThird Party Advisory
- http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd ExploitThird Party Advisory
- http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706 US Government Resource
CPE matches (NVD) (1)
cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*< 3.2.2