CVE-2022-24706
Remote Code Execution Vulnerability in Packaging
9.8
CRITICAL
CVSS 3.1
⚠ KEVEPSS 94.4%
Description
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
How to fix CVE-2022-24706
To remediate CVE-2022-24706, upgrade the affected package to a fixed version below.
- —upgrade to 3.2.2 or later
Is CVE-2022-24706 being exploited?
Yes — CVE-2022-24706 is on the CISA Known Exploited Vulnerabilities (KEV) catalog. Patch immediately.
Affected packages (1)
- from 0, < 3.2.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |