ApacheCVELIST:CVE-2022-24706CVE-2022-24706 Remote Code Execution Vulnerability in Packaging
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
CNA Affected
[
{
"vendor": "Apache Software Foundation",
"product": "Apache CouchDB",
"versions": [
{
"version": "Apache CouchDB",
"status": "affected",
"lessThanOrEqual": "3.2.1",
"versionType": "custom"
}
]
}
]References
packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html
packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html
www.openwall.com/lists/oss-security/2022/04/26/1
www.openwall.com/lists/oss-security/2022/05/09/1
www.openwall.com/lists/oss-security/2022/05/09/2
www.openwall.com/lists/oss-security/2022/05/09/3
www.openwall.com/lists/oss-security/2022/05/09/4
docs.couchdb.org/en/3.2.2/setup/cluster.html
lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00
medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd
Related
