返回 CVE 瀏覽器

CVE-2022-24706

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2022-04-26

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Affected Platforms (CPE)

📦

Apache

Couchdb

< 3.2.2

References & Advisories

🔗 http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html

🔗 http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html

🔗 http://www.openwall.com/lists/oss-security/2022/04/26/1

🔗 http://www.openwall.com/lists/oss-security/2022/05/09/1

🔗 http://www.openwall.com/lists/oss-security/2022/05/09/2

🔗 http://www.openwall.com/lists/oss-security/2022/05/09/3

🔗 http://www.openwall.com/lists/oss-security/2022/05/09/4

🔗 https://docs.couchdb.org/en/3.2.2/setup/cluster.html

相關資安分析文章

全球網絡威脅情報摘要：2026 年 7 月 20 日

本期報告深入技術拆解 UTA0533 利用 SonicWall SMA1000 零日漏洞鏈進行 root 權限執行攻擊、NGINX 正規表示式堆疊毀損 DoS 漏洞 (CVE-2026-42533)，以及 Sandworm (UAC-0145) ClickFix 偽造驗證碼攻擊手法。

相關漏洞威脅

CVE-2026-5435010.0

Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads ev...

CVE-2024-399193.1

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with sto...

CVE-2024-399184.3

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with sto...

CVE-2023-278775.3

IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure pass...