{"id":"CVE-2022-24706","published":"2022-04-26T10:15:35Z","modified":"2026-06-17T04:32:20Z","title":"Apache CouchDB Insecure Default Initialization of Resource Vulnerability","vendor":"Apache","product":"CouchDB","tier":"core","eol":null,"description":{"text":"In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.","provenance":"source","from":"NVD"},"summary":{"text":"Apache CouchDB, prior to 3.2.2, ships with an insecure default initialization that leaves the database's administrative functions exposed. An attacker with network access to an unsecured default installation can, without authenticating or user interaction, gain admin privileges, provided no firewall or other protection restricts access as the CouchDB documentation recommends.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:28Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.9251,"percentile":0.99826,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-08-25","dueDate":"2022-09-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00;  https://nvd.nist.gov/vuln/detail/CVE-2022-24706","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-06","exploitedFirstSeen":"2022-03-06","ransomware":false,"evidence":[{"url":"https://www.countercraftsec.com/blog/active-exploitation-of-confluence-cve-2022-26134/","date":"2022-03-06"},{"url":"https://www.countercraftsec.com/blog/active-exploitation-of-apache-couchdb-cve-2022-24706/","date":"2022-05-30"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-08-25"},{"url":"https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf","date":"2024-05-10"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-1188","name":"Initialization of a Resource with an Insecure Default"}],"references":[{"url":"http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/26/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/09/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/09/2","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/09/3","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/09/4","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://docs.couchdb.org/en/3.2.2/setup/cluster.html","tags":["Broken Link","Product"]},{"url":"https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00","tags":["Mailing List","Vendor Advisory"]},{"url":"https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd","tags":["Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/26/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/09/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/09/2","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/09/3","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/09/4","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://docs.couchdb.org/en/3.2.2/setup/cluster.html","tags":["Broken Link","Product"]},{"url":"https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00","tags":["Mailing List","Vendor Advisory"]},{"url":"https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated network access to exposed default service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"an attacker can access an improperly secured default installation without authenticating","start":34,"end":122}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Gains admin-level valid access after exploitation","mappingType":"primary_impact","evidence":[{"from":"description","quote":"gain admin privileges","start":127,"end":148}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-29572","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29572","exploited":true,"exploitedSince":"2022-08-25","provenance":"source"},"exploits":[{"id":50914,"url":"https://www.exploit-db.com/exploits/50914","title":"Apache CouchDB 3.2.1 - Remote Code Execution (RCE)","type":"remote","platform":"linux","date":"2022-05-11","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-05-11"},"pocGithub":{"count":4,"skipped":1,"earliest":"2022-05-20","earliestUrl":"https://github.com/sadshade/CVE-2022-24706-CouchDB-Exploit","repos":[{"name":"sadshade/CVE-2022-24706-CouchDB-Exploit","url":"https://github.com/sadshade/CVE-2022-24706-CouchDB-Exploit","stars":29,"created":"2022-05-20"},{"name":"ahmetsabrimert/Apache-CouchDB-CVE-2022-24706-RCE-Exploits-Blog-post-","url":"https://github.com/ahmetsabrimert/Apache-CouchDB-CVE-2022-24706-RCE-Exploits-Blog-post-","stars":1,"created":"2022-06-14"},{"name":"superzerosec/CVE-2022-24706","url":"https://github.com/superzerosec/CVE-2022-24706","stars":0,"created":"2022-07-04"},{"name":"becrevex/CVE-2022-24706","url":"https://github.com/becrevex/CVE-2022-24706","stars":0,"created":"2024-10-08"}]},"metasploit":[{"name":"Apache Couchdb Erlang RCE","module":"exploit/multi/http/apache_couchdb_erlang_rce","type":"exploit","disclosureDate":"2022-01-21","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_couchdb_erlang_rce.rb"}],"nuclei":[{"id":"CVE-2022-24706","name":"CouchDB Erlang Distribution - Remote Command Execution","severity":"critical","path":"network/cves/2022/CVE-2022-24706.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2022/CVE-2022-24706.yaml"}],"first":{"date":"2022-01-21","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_couchdb_erlang_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html","http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html","https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2022-01-21","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2022-05-11, PoC-in-GitHub 2022-05-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_couchdb_erlang_rce.rb","provenance":"source"},{"date":"2022-03-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.countercraftsec.com/blog/active-exploitation-of-confluence-cve-2022-26134/","provenance":"source"},{"date":"2022-04-26","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24706","provenance":"source"},{"date":"2022-08-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-08-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29572","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":121},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1698 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9983"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 1 Exploit-DB entry; 4 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}