CVE-2022-21330
Published: 19 January 2022
Summary
CVE-2022-21330 is a medium-severity an unspecified weakness vulnerability in Oracle Mysql. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Vulnerability CVE-2022-21330 affects the Cluster: General component of Oracle MySQL Cluster in versions 7.5.24 and prior, 7.6.20 and prior, and 8.0.27 and prior. It is a difficult-to-exploit issue that requires an attacker to have high privileges and direct access to the physical network segment connected to the MySQL Cluster hardware, along with human interaction from another party, and carries a CVSS 3.1 base score of 6.3 with high impacts to confidentiality, integrity, and availability.
An attacker meeting those conditions can achieve full takeover of the MySQL Cluster installation. The attack vector is adjacent-network only and depends on physical segment access plus social engineering or other user actions, limiting the pool of potential exploiters to highly privileged insiders or those already positioned on the relevant hardware network.
Oracle addressed the issue in its January 2022 Critical Patch Update, with additional notices published by NetApp and the Zero Day Initiative that reference the same Oracle advisory for remediation guidance.
The EPSS score has remained flat at its peak value of 0.1143 with no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26555
Vulnerability details
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the…
more
physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.