CVE-2022-24706

Known Exploited Public Exploit
Remote Code Execution Vulnerability in Packaging

Description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Remediation

Workaround:

  • CouchDB 3.2.2 and onwards will refuse to start with the former default Erlang cookie value of `monster`. Installations that upgrade to this versions are forced to choose a different value. In addition, all binary packages have been updated to bind `epmd` as well as the CouchDB distribution port to `127.0.0.1` and/or `::1` respectively.

Category

9.8
CVSS
Severity: Critical
CVSS 3.1 •
CVSS 2.0 •
EPSS 94.41% Top 5%
KEV Since 
Vendor Advisory apache.org
Affected: Apache Software Foundation Apache CouchDB
Published at:
Updated at:

References

Link Tags
https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00 mailing list vendor advisory
https://docs.couchdb.org/en/3.2.2/setup/cluster.html broken link product
http://www.openwall.com/lists/oss-security/2022/04/26/1 third party advisory mailing list
http://www.openwall.com/lists/oss-security/2022/05/09/1 third party advisory mailing list
http://www.openwall.com/lists/oss-security/2022/05/09/3 mailing list third party advisory patch
http://www.openwall.com/lists/oss-security/2022/05/09/4 mailing list third party advisory patch
http://www.openwall.com/lists/oss-security/2022/05/09/2 mailing list third party advisory patch
http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html exploit vdb entry third party advisory
https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd third party advisory exploit
http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html exploit vdb entry third party advisory

Frequently Asked Questions

What is the severity of CVE-2022-24706?
CVE-2022-24706 has been scored as a critical severity vulnerability.
How to fix CVE-2022-24706?
As a workaround for remediating CVE-2022-24706: CouchDB 3.2.2 and onwards will refuse to start with the former default Erlang cookie value of `monster`. Installations that upgrade to this versions are forced to choose a different value. In addition, all binary packages have been updated to bind `epmd` as well as the CouchDB distribution port to `127.0.0.1` and/or `::1` respectively.
Is CVE-2022-24706 being actively exploited in the wild?
It is confirmed that CVE-2022-24706 is actively exploited. Be extra cautious if you are using vulnerable components. According to its EPSS score, there is a ~94% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-24706?
CVE-2022-24706 affects Apache Software Foundation Apache CouchDB.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.