CVE-2022-21482
Published: 19 April 2022
Summary
CVE-2022-21482 is a medium-severity an unspecified weakness vulnerability in Netapp Active Iq Unified Manager. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 5.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Vulnerability CVE-2022-21482 affects the Cluster: General component of Oracle MySQL Cluster in versions 8.0.28 and earlier. It is a difficult-to-exploit issue that requires an attacker to have high privileges and physical access to the communication segment attached to the hardware running the cluster, plus human interaction from another party, before a successful attack can lead to full takeover of the MySQL Cluster instance.
An attacker positioned on the local network segment can leverage the flaw to compromise confidentiality, integrity, and availability, ultimately seizing control of the affected cluster. The CVSS 3.1 vector (AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) reflects these constraints and the resulting high impact on the target system.
Oracle's April 2022 CPU and the associated NetApp advisory address the issue through the standard patch distribution for MySQL Cluster; administrators are directed to apply the updates referenced in those bulletins to eliminate the exposure. The EPSS score has remained flat at its recorded peak of 0.1326 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26706
Vulnerability details
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware…
more
where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.