CVE-2022-24706

Apache CouchDB Insecure Default Initialization of Resource Vulnerability

Couchdb

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

26. Apr 2022

Ausgewertete Quellen

• Hersteller
  https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00
• Hinweis
  http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html
• Hinweis
  http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html
• Hinweis
  http://www.openwall.com/lists/oss-security/2022/04/26/1
• Hinweis
  http://www.openwall.com/lists/oss-security/2022/05/09/1
• Hinweis
  http://www.openwall.com/lists/oss-security/2022/05/09/2
• Hinweis
  http://www.openwall.com/lists/oss-security/2022/05/09/3
• Hinweis
  http://www.openwall.com/lists/oss-security/2022/05/09/4
• Hinweis
  https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706
• CISA
  Apache CouchDB Insecure Default Initialization of Resource Vulnerability
• NVD
  CVE-2022-24706