CVE-2022-24706

CVE-2022-24706 is a critical-severity (CVSS 9.8) vulnerability in Apache CouchDB. CISA added it to the Known Exploited Vulnerabilities catalog on August 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 15, 2022. CISA does not currently list it as used in ransomware campaigns. Apache has 41 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html
• http://www.openwall.com/lists/oss-security/2022/04/26/1
• http://www.openwall.com/lists/oss-security/2022/05/09/1
• http://www.openwall.com/lists/oss-security/2022/05/09/2
• http://www.openwall.com/lists/oss-security/2022/05/09/3
• http://www.openwall.com/lists/oss-security/2022/05/09/4
• https://docs.couchdb.org/en/3.2.2/setup/cluster.html