CVE-2022-21380
Published: 19 January 2022
Summary
CVE-2022-21380 is a medium-severity an unspecified weakness vulnerability in Oracle Mysql Server. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 3.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-21380 is a vulnerability in the Cluster: General component of Oracle MySQL Cluster. It affects supported versions 7.4.34 and earlier, 7.5.24 and earlier, 7.6.20 and earlier, and 8.0.27 and earlier. The flaw is rated with a CVSS 3.1 base score of 6.3 and is described as difficult to exploit, requiring an attacker to be positioned on the same physical network segment as the target hardware.
An attacker with high privileges and access to the attached communication segment can exploit the issue to take over the MySQL Cluster instance. Successful exploitation also requires human interaction from a user other than the attacker and can impact the confidentiality, integrity, and availability of the affected cluster.
Oracle addressed the issue in its January 2022 Critical Patch Update. NetApp and Zero Day Initiative have published corresponding advisories that point to the same Oracle bulletin for remediation guidance and updated software versions.
The associated EPSS score reached a peak of 0.3056 with no subsequent decline reported.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26604
Vulnerability details
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with…
more
access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.