CVE-2022-24706

CRITICALCISA KEV

9.8

Beschreibung

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht4/26/2022

Zuletzt geandert10/28/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerApache

ProduktCouchDB

SchwachstellennameApache CouchDB Insecure Default Initialization of Resource Vulnerability

KEV Aufnahmedatum2022-08-25

Behebungsfrist2022-09-15

Ransomware-NutzungUnknown

Betroffene Produkte

apache:couchdb

Schwachen (CWE)

CWE-1188CWE-1188

Referenzen

http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html(security@apache.org)

http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html(security@apache.org)

http://www.openwall.com/lists/oss-security/2022/04/26/1(security@apache.org)

http://www.openwall.com/lists/oss-security/2022/05/09/1(security@apache.org)

http://www.openwall.com/lists/oss-security/2022/05/09/2(security@apache.org)

http://www.openwall.com/lists/oss-security/2022/05/09/3(security@apache.org)

http://www.openwall.com/lists/oss-security/2022/05/09/4(security@apache.org)

https://docs.couchdb.org/en/3.2.2/setup/cluster.html(security@apache.org)

https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00(security@apache.org)

https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd(security@apache.org)

http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2022/04/26/1(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2022/05/09/1(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2022/05/09/2(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2022/05/09/3(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2022/05/09/4(af854a3a-2127-422b-91ae-364da2661108)

https://docs.couchdb.org/en/3.2.2/setup/cluster.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00(af854a3a-2127-422b-91ae-364da2661108)

https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.