by Kastro
Paper/Archive/CVE-2022-24706

CVE-2022-24706

Apache Software Foundation Apache CouchDB — Remote Code Execution Vulnerability in Packaging

KEV · due 15 SepEPSS 93%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.8.998 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Affected

ProductAffectedFixed inSource
Apache CouchDBApache CouchDB – 3.2.1–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

reflists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00refdocs.couchdb.org/en/3.2.2/setup/cluster.htmlrefopenwall.com/lists/oss-security/2022/04/26/1refopenwall.com/lists/oss-security/2022/05/09/1refopenwall.com/lists/oss-security/2022/05/09/3refopenwall.com/lists/oss-security/2022/05/09/4refopenwall.com/lists/oss-security/2022/05/09/2refpacketstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.htmlrefmedium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcdrefpacketstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706kevcisa.gov/known-exploited-vulnerabilities-catalog