Back to CVE Browser

CVE-2022-24706

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2022-04-26

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Affected Platforms (CPE)

📦

Apache

Couchdb

< 3.2.2

References & Advisories

🔗 http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html

🔗 http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html

🔗 http://www.openwall.com/lists/oss-security/2022/04/26/1

🔗 http://www.openwall.com/lists/oss-security/2022/05/09/1

🔗 http://www.openwall.com/lists/oss-security/2022/05/09/2

🔗 http://www.openwall.com/lists/oss-security/2022/05/09/3

🔗 http://www.openwall.com/lists/oss-security/2022/05/09/4

🔗 https://docs.couchdb.org/en/3.2.2/setup/cluster.html

Related Security Intelligence Articles

Global Cyber Intel Digest: July 20, 2026

Technical analysis of zero-day exploit chains against SonicWall SMA1000 appliances (UTA0533), NGINX regular expression heap corruption vulnerabilities (CVE-2026-42533), and Sandworm's (UAC-0145) ClickFix fake CAPTCHA campaigns.

Related Vulnerabilities

CVE-2026-5435010.0

Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads ev...

CVE-2024-399193.1

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with sto...

CVE-2024-399184.3

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with sto...

CVE-2023-278775.3

IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure pass...