CVE-2022-24706: Apache CouchDB Insecure Default Initialization of Resource Vulnerability

Vulnerability summary

CVE-2022-24706 is a high (CVSS 10.0) vulnerability in Apache CouchDB. It is known to be exploited: CISA lists it, first on 25-08-2022. EPSS estimates a 92.51% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 5 public exploits are recorded.

Timeline

1. 26-04-2022
   PublishedVulnerability first disclosed.
2. 25-08-2022
   Added to CISA KEVApache CouchDB Insecure Default Initialization of Resource Vulnerability
3. 15-09-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

• CWE-1188Initialization of a Resource with an Insecure DefaultThe product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.