CVE-2022-21322
Published: 19 January 2022
Summary
CVE-2022-21322 is a medium-severity an unspecified weakness vulnerability in Oracle Mysql. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Vulnerability CVE-2022-21322 affects the Cluster: General component of Oracle MySQL Cluster in versions 8.0.27 and earlier. It is a difficult-to-exploit flaw that requires an attacker to have high privileges and direct access to the physical network segment connected to the MySQL Cluster hardware, plus human interaction from another party, before a successful compromise can lead to full takeover of the cluster. The CVSS 3.1 base score is 6.3 with impacts to confidentiality, integrity, and availability.
An attacker positioned on the same physical communication segment can leverage the vulnerability to take control of the MySQL Cluster instance after the required user interaction occurs. Because the attack vector is adjacent-network and demands both elevated privileges and physical-layer access, exploitation is limited to insiders or attackers who have already gained a foothold on the local network hardware.
Oracle's January 2022 Critical Patch Update and related NetApp advisories direct customers to apply the fixes released for MySQL Cluster 8.0.27 and to review the corresponding security alert for patch availability and configuration guidance. The Zero Day Initiative advisory ZDI-22-107 provides additional technical context on the issue for organizations tracking coordinated disclosures.
The EPSS score remains flat at its peak value of 0.1143 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26547
Vulnerability details
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware…
more
where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.