CVE-2022-21334
Published: 19 January 2022
Summary
CVE-2022-21334 is a medium-severity an unspecified weakness vulnerability in Oracle Mysql. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-21334 is a vulnerability in the Cluster: General component of Oracle MySQL Cluster versions 8.0.27 and earlier. The flaw is rated 6.3 under CVSS 3.1 with the vector AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H, indicating impacts to confidentiality, integrity, and availability that can culminate in full takeover of the affected cluster.
Exploitation requires an attacker with high privileges who already has access to the physical network segment connected to the MySQL Cluster hardware. The attack is further complicated by the need for human interaction from a separate user, making successful compromise difficult but potentially resulting in complete control of the cluster if those conditions are met.
Oracle's January 2022 Critical Patch Update addresses the issue for supported MySQL Cluster releases, and NetApp has published corresponding advisory guidance for affected products. The Zero Day Initiative entry ZDI-22-119 provides additional technical context on the flaw.
The associated EPSS score has remained flat at a peak of 0.1143 with no material upward movement after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26559
Vulnerability details
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware…
more
where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.