CVE-2022-24706
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 94.39%
- CISA KEV
- Known exploited vulnerability
- CWE
- CWE-1188
- Published
- 2022-04-26
- Last modified
- 2026-09-16
Affected products
- Apache Software Foundation Apache CouchDB
Weakness type
Related vulnerabilities
- CVE-2023-27524 — Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
- CVE-2023-6448 — Unitronics VisiLogic uses a default administrative password
- CVE-2021-41192 — Insecure default configuration
- CVE-2026-47668 — DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
- CVE-2024-2912 — Insecure Deserialization Leading to RCE in bentoml/bentoml
- CVE-2026-52824 — Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
- CVE-2026-31957 — Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments
- CVE-2026-28775 — Unauthenticated RCE via SNMP Default Writable Community String