{
    "id": "CVE-2022-24706",
    "published": "2022-04-26 10:15:35",
    "last_modified": "2026-06-17 04:32:20",
    "cvss_score": "9.8",
    "cvss_severity": "CRITICAL",
    "cvss_version": "3.1",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "cwe": "CWE-1188",
    "description": "In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.",
    "epss_score": "0.92510",
    "epss_percentile": "0.99825",
    "kev": 1,
    "kev_due": "2022-09-15",
    "has_exploit": 1,
    "updated_at": "2026-09-26 18:29:20",
    "priority": {
        "rank": 1,
        "label": "Patch first",
        "why": "On CISA KEV — known exploited in the wild, due 2022-09-15."
    },
    "products": [
        {
            "vendor": "apache",
            "product": "couchdb"
        }
    ],
    "kev_detail": {
        "cve_id": "CVE-2022-24706",
        "date_added": "2022-08-25",
        "due_date": "2022-09-15",
        "vendor": "Apache",
        "product": "CouchDB",
        "name": "Apache CouchDB Insecure Default Initialization of Resource Vulnerability",
        "ransomware": 0
    },
    "exploits": [
        {
            "source": "exploit-db",
            "ref_id": "50914",
            "title": "Apache CouchDB 3.2.1 - Remote Code Execution (RCE)",
            "date": "2022-05-11",
            "url": "https://www.exploit-db.com/exploits/50914"
        }
    ],
    "refs_list": [
        "http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html",
        "http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html",
        "http://www.openwall.com/lists/oss-security/2022/04/26/1",
        "http://www.openwall.com/lists/oss-security/2022/05/09/1",
        "http://www.openwall.com/lists/oss-security/2022/05/09/2",
        "http://www.openwall.com/lists/oss-security/2022/05/09/3",
        "http://www.openwall.com/lists/oss-security/2022/05/09/4",
        "https://docs.couchdb.org/en/3.2.2/setup/cluster.html",
        "https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00",
        "https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd",
        "http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html",
        "http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html",
        "http://www.openwall.com/lists/oss-security/2022/04/26/1",
        "http://www.openwall.com/lists/oss-security/2022/05/09/1",
        "http://www.openwall.com/lists/oss-security/2022/05/09/2",
        "http://www.openwall.com/lists/oss-security/2022/05/09/3",
        "http://www.openwall.com/lists/oss-security/2022/05/09/4",
        "https://docs.couchdb.org/en/3.2.2/setup/cluster.html",
        "https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00",
        "https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd",
        "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706"
    ]
}