Read the docs
TI-2022-08521 Aliases CVE-2022-24706GHSA-vxc9-8m8h-9cp6

Remote Code Execution Vulnerability in Packaging

Priority CRITICAL 100Exploited in the wildCWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Why it matters now

Exploitation Active In CISA KEV since 2022-08-25CISA due date 2022-09-15
EPSS 0.9251 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache CouchDBApache CouchDB – 3.2.1—No fix listedCNA
  • Apache CouchDB VendorApache Affected Apache CouchDB – 3.2.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*before 3.2.2VulnerableApache
  • cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:* Versions before 3.2.2 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2022-08-25 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2022-24706
  3. 2026-10-03 Alias added: GHSA-vxc9-8m8h-9cp6

References

Exploit 3

Patch 3

Advisory 3

Other 1

  • TI-2017-09360 Improper privilege management in Apache CouchDB CVSS 3.0CRITICAL 9.8
  • TI-2017-09361 OS command injection in Apache CouchDB CVSS 3.0HIGH 7.2
  • TI-2020-01879 Missing authentication in Apache CouchDB CVSS 3.1CRITICAL 9.8
  • TI-2018-05784 Improper input validation in Apache CouchDB CVSS 3.0HIGH 7.2
  • TI-2018-08426 CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). CVSS 3.0HIGH 7.2
  • TI-2014-02145 Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service… CVSS 2.0MEDIUM 5.0
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences