What’s Vulnerable › Vulnerabilities

CVE-2022-24706: Apache CouchDB Insecure Default Initialization of Resource Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-08-25
• EPSS: 92.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-26 · updated 2026-06-17
• Weakness: CWE-1188

Description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Affected products

• Apache Software Foundation Apache CouchDB: before 3.2.2 — fixed in 3.2.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CouchDB 3.2.2. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html
• http://www.openwall.com/lists/oss-security/2022/04/26/1
• http://www.openwall.com/lists/oss-security/2022/05/09/1
• http://www.openwall.com/lists/oss-security/2022/05/09/2
• http://www.openwall.com/lists/oss-security/2022/05/09/3
• http://www.openwall.com/lists/oss-security/2022/05/09/4
• https://docs.couchdb.org/en/3.2.2/setup/cluster.html
• https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00
• https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd
• http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html

Get alerted when CVE-2022-24706 or the next vulnerability affects your stack