peter bassill · operator
$ cve CVE-2022-24706 JSON

CVE-2022-24706 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 92.5% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-09-15.

Description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS92.51% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-1188
On CISA KEVyes — remediate by 2022-09-15
Public exploityes
Published2022-04-26
Last modified2026-06-17

CISA KEV

NameApache CouchDB Insecure Default Initialization of Resource Vulnerability
Added2022-08-25
Due2022-09-15
Vendor / productApache / CouchDB
Ransomware usenone reported

Affected (1)

VendorProduct
apachecouchdb

Public exploits

SourceTitleDate
exploit-dbApache CouchDB 3.2.1 - Remote Code Execution (RCE)2022-05-11

References

→ the Explorer  ·  watch your stack  ·  NVD