Apache CouchDB Insecure Default Initialization of Resource Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2022-24706 · Published 26/04/2022 · updated 17/06/2026

Apache CouchDB Insecure Default Initialization of Resource Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/08/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
couchdb apache	`< 3.2.2`	`3.2.2`

Description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

References

packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html · Exploit
packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html · Exploit
openwall.com/lists/oss-security/2022/04/26/1 · Mailing List
openwall.com/lists/oss-security/2022/05/09/1 · Mailing List
openwall.com/lists/oss-security/2022/05/09/2 · Mailing List
openwall.com/lists/oss-security/2022/05/09/3 · Mailing List
openwall.com/lists/oss-security/2022/05/09/4 · Mailing List
docs.couchdb.org/en/3.2.2/setup/cluster.html · Broken Link
lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00 · Mailing List
medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2022-24706

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free