CVE-2022-21287
Published: 19 January 2022
Summary
CVE-2022-21287 is a medium-severity an unspecified weakness vulnerability in Oracle Mysql. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Vulnerability CVE-2022-21287 affects the Cluster: General component of Oracle MySQL Cluster in supported versions 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior, and 8.0.27 and prior. It is a difficult-to-exploit issue that requires an attacker to have high privileges and physical access to the communication segment attached to the hardware running the cluster, along with human interaction from another party, and can lead to full takeover of the MySQL Cluster with impacts to confidentiality, integrity, and availability.
An attacker positioned on the local network segment can leverage the flaw to compromise the cluster when the additional conditions are met, resulting in complete control over the affected MySQL Cluster instance. The CVSS 3.1 score of 6.3 reflects the combination of high attack complexity, required privileges, and user interaction.
Oracle's January 2022 Critical Patch Update and related NetApp and Zero Day Initiative advisories address the issue through available patches for the impacted MySQL Cluster releases. The EPSS score has remained flat at 0.1143 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26512
Vulnerability details
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with…
more
access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.