CVE-2022-24706

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1188

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2022
Last modified: Jun 17, 2026
Added to CISA KEV: Aug 25, 2022
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-247078.8Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection CVE-2022-247085.4Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to CVE-2022-247096.1@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface CVE-2022-24719.8Stack-based Buffer Overflow vulnerability in the EZVIZ Motion Detection component as used in camera models CS-CV248, CS-C6N-A0-1C2WFR, CS-DB CVE-2022-247105.4Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used i CVE-2022-247119.8CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerab CVE-2022-247128.8CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote CVE-2022-247137.5regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of CVE-2022-247145.3Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer CVE-2022-247158.8Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the confi CVE-2022-247167.5Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents o CVE-2022-247176.1ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5, a cross site scripting (XSS) i