Actively exploited in the wild
Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Apache - CouchDB · Listed in the CISA KEV since 2022-08-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-24706
CriticalCVSS 9.8KEVSummary
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The documentation has always recommended proper security measures, including a firewall.
Risk Assessment
An unauthenticated attacker can gain full control of the CouchDB database, potentially leading to data confidentiality and integrity compromise.
Recommendation
Update Apache CouchDB to version 3.2.2 or later and apply recommended security measures such as firewall and authentication.
Other vulnerabilities in Apache CouchDB
See all- CVE-2017-12636High
CouchDB administrative users can configure the database server via HTTP(S), allowing them to specify paths for operating system-level binaries. This enables the CouchDB user to execute arbitrary shell commands, including downloading and executing scripts from the public internet.
- CVE-2017-12635Critical
In Apache CouchDB before version 1.7.0 and 2.x before version 2.1.1, a vulnerability allows submitting _users documents with duplicate 'roles' keys, which can lead to non-admin users being granted admin privileges.
Original NVD description (English source)
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.