CVE-2022-24706

Name
CVE-2022-24706
Description
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
NVD Severity
high
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00
MISC https://docs.couchdb.org/en/3.2.2/setup/cluster.html
MLIST http://www.openwall.com/lists/oss-security/2022/04/26/1
MLIST http://www.openwall.com/lists/oss-security/2022/05/09/4
MLIST http://www.openwall.com/lists/oss-security/2022/05/09/1
MLIST http://www.openwall.com/lists/oss-security/2022/05/09/2
MLIST http://www.openwall.com/lists/oss-security/2022/05/09/3
MISC http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html
Exploit https://medium.com/@_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd
Exploit http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html
https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:* couchdb >= None < 3.2.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status