CVE-2022-21320
Published: 19 January 2022
Summary
CVE-2022-21320 is a medium-severity an unspecified weakness vulnerability in Oracle Mysql. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Vulnerability CVE-2022-21320 affects the Cluster: General component of Oracle MySQL Cluster in versions 8.0.27 and earlier. It is rated with a CVSS 3.1 base score of 6.3 under the vector AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H and is described as difficult to exploit, with successful attacks resulting in full takeover of the MySQL Cluster instance.
An attacker must possess high privileges and direct access to the physical communication segment attached to the hardware running the cluster. Exploitation also requires human interaction from a user other than the attacker, after which the attacker can compromise confidentiality, integrity, and availability to achieve complete control of the affected cluster.
The referenced Oracle Critical Patch Update for January 2022 and the associated NetApp advisory address remediation for this issue, while the Zero Day Initiative entry ZDI-22-105 provides additional technical context on the flaw.
The EPSS score for the CVE stands at 0.1143 with no material change from its recorded peak.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26545
Vulnerability details
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware…
more
where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.