Authentication Bypass in MySQL Cluster from Oracle
CVE-2022-21483

6.3MEDIUM

Key Information:

Vendor
Oracle
Status
Mysql Cluster
Vendor
CVE Published:
19 April 2022

Summary

A vulnerability exists in the MySQL Cluster product that allows a highly privileged attacker, with physical access to the communication segment, to potentially compromise the cluster. Successful exploitation requires interaction from a user other than the attacker, making the attack vector complex. If exploited, this vulnerability could lead to a complete takeover of the MySQL Cluster, affecting confidentiality, integrity, and availability of the system.

Affected Version(s)

MySQL Cluster 7.4.35 and prior

MySQL Cluster 7.5.25 and prior

MySQL Cluster 7.6.21 and prior

References

https://www.oracle.com/security-alerts/cpuapr2022.html
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20220429-0005/
x_refsource_CONFIRM

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.