Non notée
Exploitée
CVE-2022-24706 Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply updates per vendor instructions.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-1188
Description
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache CouchDB 3.2 | premières → 3.2.1 | Pas de correctif indiqué |
Références
- lists.apache.org lists.apache.org
- docs.couchdb.org docs.couchdb.org
- [oss-security] 20220426 CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging www.openwall.com
- [oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging www.openwall.com
- [oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging www.openwall.com
- [oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging www.openwall.com
- [oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging www.openwall.com
- packetstormsecurity.com packetstormsecurity.com
- medium.com medium.com
- packetstormsecurity.com packetstormsecurity.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de Apache CouchDB
Les 16 CVE de Apache CouchDB →
CVE-2026-107755
Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms…
6.0
Moyenne
CVE-2026-90800
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the…
8.1
Élevée
CVE-2026-90799
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated…
1.3
Faible
CVE-2026-90798
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a…
0.6
Faible