Actively exploited · Published Apr 26, 2022 · Assigned by apache

CVE-2022-24706Remote Code Execution Vulnerability in Packaging

Critical 9.8 Exploited

In plain English

A critical-severity security flaw in Apache CouchDB from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on August 25, 2022). The chance it is exploited in the next 30 days is estimated at 92.5% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)92.5%top 0.2% of all CVEs

Exploited in the wildYesCISA KEV since Aug 25, 2022

Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Sep 15, 2022.

Official description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache CouchDB	Apache CouchDB – through 3.2.1

Weakness: CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

CISA guidance

Official description

Affected products (as reported)

References