CVE-2022-24706 - Vulnerability Details - OpenCVE

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is in the KEV database since Aug. 25, 2022.

Exploitation active

Automatable yes

Technical Impact total

Vendors	Products
Apache	Couchdb

Configuration 1 [-]

cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html
http://www.openwall.com/lists/oss-security/2022/04/26/1
http://www.openwall.com/lists/oss-security/2022/05/09/1
http://www.openwall.com/lists/oss-security/2022/05/09/2
http://www.openwall.com/lists/oss-security/2022/05/09/3
http://www.openwall.com/lists/oss-security/2022/05/09/4
https://docs.couchdb.org/en/3.2.2/setup/cluster.html
https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00
https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd

History

Wed, 29 Jan 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2022-08-25'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2022-04-26T00:00:00.000Z

Updated: 2025-01-29T16:14:43.712Z

Reserved: 2022-02-10T00:00:00.000Z

Link: CVE-2022-24706

Vulnrichment

Updated: 2024-08-03T04:20:50.213Z

NVD

Status : Modified

Published: 2022-04-26T10:15:35.083

Modified: 2025-01-29T17:15:17.557

Link: CVE-2022-24706

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-24706", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "dateUpdated": "2025-01-29T16:14:43.712Z", "dateReserved": "2022-02-10T00:00:00.000Z", "datePublished": "2022-04-26T00:00:00.000Z"}, "containers": {"cna": {"title": "Remote Code Execution Vulnerability in Packaging", "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2022-11-02T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations."}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache CouchDB", "versions": [{"version": "Apache CouchDB", "status": "affected", "lessThanOrEqual": "3.2.1", "versionType": "custom"}]}], "references": [{"url": "https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00"}, {"url": "https://docs.couchdb.org/en/3.2.2/setup/cluster.html"}, {"name": "[oss-security] 20220426 CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2022/04/26/1"}, {"name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/1"}, {"name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/3"}, {"name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/4"}, {"name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/2"}, {"url": "http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html"}, {"url": "https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd"}, {"url": "http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html"}], "credits": [{"lang": "en", "value": "The Apache CouchDB Team would like to thank Alex Vandiver <alexmv@zulip.com> for the report of this issue."}], "metrics": [{"other": {"type": "unknown", "content": {"other": "critical"}}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-1188 Insecure Default Initialization of Resource", "cweId": "CWE-1188"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"discovery": "UNKNOWN"}, "workarounds": [{"lang": "en", "value": "CouchDB 3.2.2 and onwards will refuse to start with the former default\nErlang cookie value of `monster`. Installations that upgrade to this\nversions are forced to choose a different value.\n\nIn addition, all binary packages have been updated to bind `epmd` as\nwell as the CouchDB distribution port to `127.0.0.1` and/or `::1`\nrespectively."}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:20:50.213Z"}, "title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00", "tags": ["x_transferred"]}, {"url": "https://docs.couchdb.org/en/3.2.2/setup/cluster.html", "tags": ["x_transferred"]}, {"name": "[oss-security] 20220426 CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/04/26/1"}, {"name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/1"}, {"name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/3"}, {"name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/4"}, {"name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/2"}, {"url": "http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html", "tags": ["x_transferred"]}, {"url": "https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html", "tags": ["x_transferred"]}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-29T16:14:35.670152Z", "id": "CVE-2022-24706", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-08-25", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-24706"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-29T16:14:43.712Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00", "tags": ["x_transferred"]}, {"url": "https://docs.couchdb.org/en/3.2.2/setup/cluster.html", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/04/26/1", "name": "[oss-security] 20220426 CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/05/09/1", "name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/05/09/3", "name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/05/09/4", "name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/05/09/2", "name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html", "tags": ["x_transferred"]}, {"url": "https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:20:50.213Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-24706", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-29T16:14:35.670152Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-08-25", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-24706"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-29T16:14:24.292Z"}}], "cna": {"title": "Remote Code Execution Vulnerability in Packaging", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "value": "The Apache CouchDB Team would like to thank Alex Vandiver <alexmv@zulip.com> for the report of this issue."}], "metrics": [{"other": {"type": "unknown", "content": {"other": "critical"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache CouchDB", "versions": [{"status": "affected", "version": "Apache CouchDB", "versionType": "custom", "lessThanOrEqual": "3.2.1"}]}], "references": [{"url": "https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00"}, {"url": "https://docs.couchdb.org/en/3.2.2/setup/cluster.html"}, {"url": "http://www.openwall.com/lists/oss-security/2022/04/26/1", "name": "[oss-security] 20220426 CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/05/09/1", "name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/05/09/3", "name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/05/09/4", "name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/05/09/2", "name": "[oss-security] 20220509 Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging", "tags": ["mailing-list"]}, {"url": "http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html"}, {"url": "https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd"}, {"url": "http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html"}], "workarounds": [{"lang": "en", "value": "CouchDB 3.2.2 and onwards will refuse to start with the former default\nErlang cookie value of `monster`. Installations that upgrade to this\nversions are forced to choose a different value.\n\nIn addition, all binary packages have been updated to bind `epmd` as\nwell as the CouchDB distribution port to `127.0.0.1` and/or `::1`\nrespectively."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188 Insecure Default Initialization of Resource"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2022-11-02T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-24706", "state": "PUBLISHED", "dateUpdated": "2025-01-29T16:14:43.712Z", "dateReserved": "2022-02-10T00:00:00.000Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2022-04-26T00:00:00.000Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"cisaActionDue": "2022-09-15", "cisaExploitAdd": "2022-08-25", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Apache CouchDB Insecure Default Initialization of Resource Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*", "matchCriteriaId": "C49414F4-5081-4B1E-BBAC-929CE3A75A72", "versionEndExcluding": "3.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations."}, {"lang": "es", "value": "En Apache CouchDB versiones anteriores a 3.2.2, un atacante puede acceder a una instalaci\u00f3n por defecto asegurada inapropiadamente sin autenticarse y alcanzar privilegios de administrador. La documentaci\u00f3n de CouchDB siempre ha hecho recomendaciones para asegurar apropiadamente una instalaci\u00f3n, incluyendo la recomendaci\u00f3n de usar un firewall delante de todas las instalaciones de CouchDB"}], "id": "CVE-2022-24706", "lastModified": "2025-01-29T17:15:17.557", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-04-26T10:15:35.083", "references": [{"source": "security@apache.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html"}, {"source": "security@apache.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html"}, {"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/04/26/1"}, {"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/1"}, {"source": "security@apache.org", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/2"}, {"source": "security@apache.org", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/3"}, {"source": "security@apache.org", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/4"}, {"source": "security@apache.org", "tags": ["Broken Link", "Product"], "url": "https://docs.couchdb.org/en/3.2.2/setup/cluster.html"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00"}, {"source": "security@apache.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/04/26/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/05/09/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Product"], "url": "https://docs.couchdb.org/en/3.2.2/setup/cluster.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1188"}], "source": "security@apache.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-1188"}], "source": "nvd@nist.gov", "type": "Secondary"}]}