Apache · CouchDB
CVE-2022-24706
Remote Code Execution Vulnerability in Packaging
What it is
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
CISA: Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: September 15, 2022
- Added to the CISA list
- August 25, 2022
- Published
- April 26, 2022
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 93% in the top 0.2% of all known vulnerabilities
- Weakness
- CWE-1188
- More details
- NVD · CVE.org · CISA
All references (10)
- https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00
- https://docs.couchdb.org/en/3.2.2/setup/cluster.html
- http://www.openwall.com/lists/oss-security/2022/04/26/1
- http://www.openwall.com/lists/oss-security/2022/05/09/1
- http://www.openwall.com/lists/oss-security/2022/05/09/3
- http://www.openwall.com/lists/oss-security/2022/05/09/4
- http://www.openwall.com/lists/oss-security/2022/05/09/2
- http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html
- https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd
- http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html
More exploited flaws from Apache
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 8, 2026 | Command Injection | Struts | High 8.1 | 97% |
| Aug 4, 2026 | Missing Encryption of Sensitive Data | Tomcat | High 7.5 | 99% |
| Apr 16, 2026 | Improper Input Validation | ActiveMQ | High 8.8 | 98% |
| May 1, 2025 | Improper Escaping of Output | HTTP Server | Critical 9.1 | >99.9% |
| Apr 1, 2025 | Path Equivalence | Tomcat | Critical 10.0 | 99.9% |
| Feb 4, 2025 | Forced Browsing | OFBiz | Critical 9.8 | >99.9% |
| Sep 18, 2024 | Improper Access Control | HugeGraph-Server | Critical 9.8 | 99.2% |
| Aug 27, 2024 | Incorrect Authorization | OFBiz | High 8.1 | 99.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.