CVE-2022-21489
Published: 19 April 2022
Summary
CVE-2022-21489 is a medium-severity an unspecified weakness vulnerability in Oracle Mysql. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 7.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Vulnerability CVE-2022-21489 affects the Cluster: General component of Oracle MySQL Cluster in versions 7.4.35 and earlier, 7.5.25 and earlier, 7.6.21 and earlier, and 8.0.28 and earlier. It is a difficult-to-exploit flaw that requires an attacker to have high privileges plus physical access to the communication segment attached to the hardware running the cluster, along with human interaction from a separate party, and carries a CVSS 3.1 base score of 6.3 with impacts to confidentiality, integrity, and availability.
An attacker meeting those prerequisites can achieve full takeover of the MySQL Cluster. The attack is limited to the local network segment and cannot be performed remotely or without the additional user interaction.
Oracle's April 2022 CPU and the related NetApp advisory direct customers to apply the patches released for the affected MySQL Cluster versions. The advisories list the specific fixed releases and recommend updating as the primary mitigation.
The associated EPSS score reached a modest peak of 0.1108 and currently sits at 0.0920, indicating limited observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26713
Vulnerability details
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with…
more
access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.