CVE-2022-24706: apache couchdb

csirt@kutim:~/threat-intel/cve/CVE-2022-24706

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 92,5%

Kerentanan Initialization of a Resource with an Insecure Default pada apache couchdb. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 25 Agustus 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Rincian

Terbit di NVD: 26 April 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-1188: Initialization of a Resource with an Insecure Default
EPSS (30 hari): 92,5% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Masuk KEV: 25 Agustus 2022
Tenggat CISA: 15 September 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	couchdb	Semua versi sebelum 3.2.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00 mailing list · advisory vendor
http://www.openwall.com/lists/oss-security/2022/05/09/2 mailing list · patch · advisory pihak ketiga
http://www.openwall.com/lists/oss-security/2022/05/09/3 mailing list · patch · advisory pihak ketiga
http://www.openwall.com/lists/oss-security/2022/05/09/4 mailing list · patch · advisory pihak ketiga
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706 pemerintah AS
http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
http://www.openwall.com/lists/oss-security/2022/04/26/1 mailing list · advisory pihak ketiga
http://www.openwall.com/lists/oss-security/2022/05/09/1 mailing list · advisory pihak ketiga
https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd exploit · advisory pihak ketiga
https://docs.couchdb.org/en/3.2.2/setup/cluster.html broken link · product

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.