Lucene search

GoogleOSV:CVE-2022-24706

HistoryApr 26, 2022 - 10:15 a.m.

CVE-2022-24706

2022-04-2610:15:35

Google

osv.dev

6.9 Medium

AI Score

Confidence

Low

0.975 High

EPSS

Percentile

100.0%

JSON

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

CPENameOperatorVersion
couchdbeq2.1.0
couchdbeq3.2.0
couchdbeq2.3.0
couchdbeq3.1.0
couchdbeq3.2.1
couchdbeq3.1.1
couchdbeqfauxton

Name	Operator	Version
couchdb	eq	2.1.0
couchdb	eq	3.2.0
couchdb	eq	2.3.0
couchdb	eq	3.1.0
couchdb	eq	3.2.1
couchdb	eq	3.1.1
couchdb	eq	fauxton

References

packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html

packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html

www.openwall.com/lists/oss-security/2022/04/26/1

www.openwall.com/lists/oss-security/2022/05/09/1

www.openwall.com/lists/oss-security/2022/05/09/2

www.openwall.com/lists/oss-security/2022/05/09/3

www.openwall.com/lists/oss-security/2022/05/09/4

docs.couchdb.org/en/3.2.2/setup/cluster.html

lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00

medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd