Skip to content
Fencer Vulns
critical 9.8

CVE-2022-24706 kev in the critical feed json

Remote Code Execution Vulnerability in Packaging

published 2022-04-26 4 y ago modified 2026-09-08 2 mo ago also BIT-couchdb-2022-24706 , EUVD-2022-29572

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2022-08-25
epss
92.5%
EPSS 92.5% chance of exploitation in 30 days, percentile 99.8%
public exploits
2
Metasploit, Exploit-DB, plus a Nuclei check

Summary

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • bitnami couchdb 3.2.2
  • apache couchdb 3.2.2

Timeline

  1. First public exploit (Metasploit exploit/multi/http/apache_couchdb_erlang_rce)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
4 y ago
Patch by
2022-09-15 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Apache, CouchDB
CISA name
Apache CouchDB Insecure Default Initialization of Resource Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction

92.51% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/multi/http/apache_couchdb_erlang_rce Apache Couchdb Erlang RCE metasploit exploit, excellent rank, 2022-01-21
  • EDB-50914 Apache CouchDB 3.2.1 - Remote Code Execution (RCE) remote, 2022-05-11
  • Nuclei template CouchDB Erlang Distribution - Remote Command Execution nuclei detection template
  • packetstormsecurity.com http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
  • medium.com https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami couchdb
<3.2.2
3.2.2

Affected products

  • Apache Software Foundation Apache CouchDB

Classification

Weakness
  • CWE-1188 Initialization of a Resource with an Insecure Default

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.