Apache CouchDB Insecure Default Initialization of Resource Vulnerability (CVE-2022-24706)

A remote attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2022-09-15 under CISA BOD 22-01.

This is a Insecure Default Initialization of Resource (CWE-1188) vulnerability in Apache CouchDB. In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations. Exploitation requires remote network access, low attack complexity, no authentication required, and no user interaction required.

Probably yes if any of these apply:

Active exploitation documented in the wild. Threat-research write-up: http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html