[ CVE-2022-24706 · Published 26 Apr 2022 ]
Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Exploited · CISA KEV CVSS 9.8
EPSS 93%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-08-25
- EPSS: 93% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 9.8
[ Description ]Official description
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
CISA: Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 15 Sep 2022): Apply updates per vendor instructions.
- Patch on openwall.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on openwall.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on openwall.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- www.openwall.com/lists/oss-security/2022/04/26/1Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2022/05/09/1Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2022/05/09/2Mailing ListPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2022/05/09/3Mailing ListPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2022/05/09/4Mailing ListPatchThird Party Advisory
- docs.couchdb.org/en/3.2.2/setup/cluster.htmlBroken LinkProduct
- lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00Mailing ListVendor Advisory
- medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcdExploitThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource