CVE-2022-21286
Published: 19 January 2022
Summary
CVE-2022-21286 is a medium-severity an unspecified weakness vulnerability in Oracle Mysql. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-21286 affects the Cluster: General component of Oracle MySQL Cluster in versions 7.4.34 and earlier, 7.5.24 and earlier, 7.6.20 and earlier, and 8.0.27 and earlier. The flaw is a difficult-to-exploit issue that permits a high-privileged attacker with access to the physical network segment attached to the MySQL Cluster hardware to compromise the product, resulting in full takeover when combined with required human interaction from a separate user.
An attacker positioned on the same physical communication segment can leverage the vulnerability to gain control of the MySQL Cluster instance. Successful exploitation requires both elevated privileges and interaction from another party, after which the attacker can impact confidentiality, integrity, and availability of the cluster.
Oracle's January 2022 Critical Patch Update and related NetApp advisories address the issue through available patches for supported MySQL Cluster releases; organizations are advised to apply the relevant updates and review the vendor bulletins for configuration guidance. The EPSS score has remained flat at its peak value of 0.1143 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26511
Vulnerability details
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with…
more
access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.