CVE-2022-24706

KEV PoC ×3—

Apache CouchDB Insecure Default Initialization of Resource Vulnerability

CVSS 3.1

9.8 critical

EPSS

93%p100

Published

Apr 26, 2022 (Apr 26, 2022)

KEV added

Aug 25, 2022

Description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

CISA Known Exploited Vulnerability

Affected: Apache CouchDB
Required action: Apply updates per vendor instructions.
Due date: Sep 15, 2022
Ransomware use: Unknown

Vendors: apache
Products: couchdb
Weakness: CWE-1188
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org CISA KEV GitHub PoCs EPSS (92.5%)

In the news2 stories

CISA Adds 10 New Known Actively Exploited Vulnerabilities to its Catalog

The Hacker NewsAug 30, 03:22 UTC · Aug 30, 2022Vulnerability in the wildCVE-2021-38406 CVE-2022-26352 CVE-2022-24706+9 CVEs

CISA adds 10 flaws to its Known Exploited Vulnerabilities Catalog

Security AffairsAug 29, 09:03 UTC · Aug 29, 2022Exploit / PoC in the wildCVE-2021-38406 CVE-2021-31010 CVE-2022-26352+7 CVEs