CVE-2022-21550
Published: 19 July 2022
Summary
CVE-2022-21550 is a medium-severity an unspecified weakness vulnerability in Oracle Mysql Cluster. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 3.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-21550 is a vulnerability in the Cluster: General component of Oracle MySQL Cluster. It affects supported versions 7.4.36 and prior, 7.5.26 and prior, 7.6.22 and prior, and 8.0.29 and prior. The flaw carries a CVSS 3.1 base score of 6.3 with the vector AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H, indicating impacts to confidentiality, integrity, and availability.
An attacker must possess high privileges and physical access to the communication segment attached to the hardware running MySQL Cluster. Exploitation is difficult, requires human interaction from another party, and can result in full takeover of the MySQL Cluster instance.
Oracle's July 2022 Critical Patch Update and related NetApp advisories address the issue through available patches for affected MySQL Cluster releases.
The EPSS score for this CVE rose from a low baseline to a peak of 0.3913, indicating that exploitation interest emerged after disclosure and that the vulnerability warrants renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26774
Vulnerability details
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.36 and prior, 7.5.26 and prior, 7.6.22 and prior and and 8.0.29 and prior. Difficult to exploit vulnerability allows high privileged attacker…
more
with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.