CVE-2022-24706

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

• CWE-1188
• CWE-1188

• http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2022/04/26/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/05/09/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/05/09/2Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/05/09/3Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/05/09/4Mailing List, Patch, Third Party Advisory
• https://docs.couchdb.org/en/3.2.2/setup/cluster.htmlBroken Link, Product
• https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00Mailing List, Vendor Advisory
• https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcdExploit, Third Party Advisory
• http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2022/04/26/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/05/09/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/05/09/2Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/05/09/3Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/05/09/4Mailing List, Patch, Third Party Advisory
• https://docs.couchdb.org/en/3.2.2/setup/cluster.htmlBroken Link, Product
• https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00Mailing List, Vendor Advisory
• https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcdExploit, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706US Government Resource

Published

Apr 26, 2022

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2470Cross-site Scripting (XSS) - Reflected in GitHub repository …6.1
• CVE-2022-24700An issue was discovered in WinAPRS 2.9.0. A buffer overflow …7.5
• CVE-2022-24701An issue was discovered in WinAPRS 2.9.0. A buffer overflow …7.8
• CVE-2022-24702An issue was discovered in WinAPRS 2.9.0. A buffer overflow …9.8
• CVE-2022-24704The rad_packet_recv function in opt/src/accel-pppd/radius/pa…9.8
• CVE-2022-24705The rad_packet_recv function in radius/packet.c suffers from…9.8
• CVE-2022-24707Anuko Time Tracker is an open source, web-based time trackin…8.8
• CVE-2022-24708Anuko Time Tracker is an open source, web-based time trackin…5.4
• CVE-2022-24709@awsui/components-react is the main AWS UI package which con…6.1
• CVE-2022-2471Stack-based Buffer Overflow vulnerability in the EZVIZ Motio…9.8
• CVE-2022-24710Weblate is a copyleft software web-based continuous localiza…5.4
• CVE-2022-24711CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…9.8