CVE-2022-24706
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges.
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 92.51%
- Chance of exploitation in the next 30 days. Higher than 99.83% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Aug 25, 2022
- Weakness
- CWE-1188 Initialization of a Resource with an Insecure Default
- CWE-1188 Initialization of a Resource with an Insecure Default
- Fix
- None yet
- No fixed version published
Description
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-1188: Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-1188: Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
References
Advisories
- packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html
- packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html
- openwall.com/lists/oss-security/2022/04/26/1
- openwall.com/lists/oss-security/2022/05/09/1
- openwall.com/lists/oss-security/2022/05/09/2
- openwall.com/lists/oss-security/2022/05/09/3
- openwall.com/lists/oss-security/2022/05/09/4
- lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00
- medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9…
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9qh4-3jw8-366w Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions | Critical | Same weakness, CWE-1188 |
| GHSA-jxxv-8r27-vm4p vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts | Critical | Same weakness, CWE-1188 |
| GHSA-p3m8-78j2-g5p3 NLTK: Default ENFORCE=False Disables All pathsec Security Controls | High | Same weakness, CWE-1188 |
| GHSA-xr9x-r78c-5hrm Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing | Critical | Same weakness, CWE-1188 |
| GHSA-jr9p-4h4j-6c58 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover | Critical | Same weakness, CWE-1188 |
| GHSA-fj8f-m44g-c479 PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats | High | Same weakness, CWE-1188 |
| GHSA-9h47-pqcx-hjr4 Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default | Critical | Same weakness, CWE-1188 |
| GHSA-5xfx-xj4h-5p7r SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() | Critical | Same weakness, CWE-1188 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor