Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.9
CVE-2022-21486: Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 an...
CVE-2022-21486 · published 4 years ago
Summary
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical...
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | oracle | mysql |
>= 7.4.0, <= 7.4.35 >= 7.5.0, <= 7.5.25 >= 7.6.0, <= 7.6.21 >= 8.0.0, <= 8.0.28 cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* |
| – | netapp | active_iq_unified_manager |
All versions
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* |
| – | netapp | oncommand_insight |
All versions
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* |
| – | netapp | snapcenter |
All versions
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* |
| Ubuntu:14.04:LTS | canonical | cluster | All versions |
| Ubuntu:14.04:LTS | canonical | mysql-5.5 | All versions |
| Ubuntu:16.04:LTS | canonical | percona-server-5.6 | All versions |
| Ubuntu:16.04:LTS | canonical | percona-xtradb-cluster-5.6 | All versions |
Original advisory text
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 an...
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L).
References
- https://ubuntu.com/security/CVE-2022-21486 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-21486 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220429-0005/ Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21486... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-21486 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Timeline
Published19 Apr 2022
Updated3 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta