{"id":"CVE-2022-24706","kind":"vulnerability","aliases":["CVE-2022-24706"],"related":[],"title":"In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without…","description":"In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.","summary":"Apache CouchDB ships with an insecure default initialization that lets an attacker escalate to administrator privileges. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":10.0,"epss":0.9251,"exploited":true,"exploited_at":"2022-08-25T00:00:00+00:00","products":[{"name":"apache couchdb","fixed":["3.2.2"],"affected":"< 3.2.2","ecosystem":"vendor"},{"name":"Apache CouchDB","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["couchdb","exploited","package","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor update per Apache CouchDB instructions; the fixed version is unknown from the sources. Verify the admin credentials and the admin-party setting in local.ini are not left at defaults.","status":"open","published_at":"2022-04-26T10:15:35+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:52+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:10:52Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Apache CouchDB instructions; the fixed version is unknown from the sources. Verify the admin credentials and the admin-party setting in local.ini are not left at defaults.","reach":"unknown","impact":"high","summary":"Apache CouchDB ships with an insecure default initialization that lets an attacker escalate to administrator privileges. CISA lists it as actively exploited in the wild.","category":"package","who_cares":["couchdb","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker gains administrator rights on the CouchDB server and its data","analyst_note":"Find the affected and fixed CouchDB versions and the exact default-config check in the Apache CouchDB security advisory for CVE-2022-24706.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000456,"input_tokens":2830,"output_tokens":346,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':18A,21A '-24706':19A,22A '3.2.2':6A,63C 'access':10A,67C 'activ':53B 'admin':77C 'administr':47B 'alway':83C 'apach':2A,33B,59C 'apache':23A,25A 'attack':8A,44B,65C 'authent':74C 'cisa':49B 'couchdb':3A,24A,26A,27B,34B,60C,80C,100C 'cve':17A,20A 'default':14A,39B,71C 'document':81C 'escal':45B 'exploit':28B,54B 'firewal':95C 'front':97C 'gain':76C 'host':32B 'improp':12A,69C 'includ':91C 'initi':40B 'insecur':38B 'instal':15A,72C,90C,101C 'let':42B 'list':50B 'made':84C 'packag':29B 'prior':4A,61C 'privileg':48B,78C 'proper':87C 'recommend':85C,92C 'secur':13A,70C,88C 'self':31B 'self-host':30B 'ship':35B 'use':93C 'wild':57B 'without':16A,73C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-04-26T10:15:35+00:00","kev":{"dateAdded":"2022-08-25","dueDate":"2022-09-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-24706","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-24706","severity":null,"published_at":"2022-08-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T17:39:57+00:00","note":null},{"source":"epss","external_id":"CVE-2022-24706","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24706","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-24706","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24706","severity":null,"published_at":"2022-04-26T10:15:35+00:00","modified_at":"2026-06-17T04:32:20+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}