Vulnerability record · CVE-2022-21279 · published 19 January 2022
CVE-2022-21279: Oracle MySQL Cluster flaw allows takeover via adjacent network
Oracle · Mysql
CVE-2022-21279 is a vulnerability in the Cluster: General component of Oracle MySQL Cluster affecting versions 7.4.34, 7.5.24, 7.6.20 and 8.0.27 and prior. It is rated difficult to exploit and requires high privileges plus human interaction, but a successful attack can fully compromise the cluster. The record gives no root-cause detail beyond the component name.
Description
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Automated analysis
medium priorityCVSS 6.3 with high privileges, adjacent access and user interaction required, though EPSS is very high and impact is full takeover.
What it is
CVE-2022-21279 is a vulnerability in the Cluster: General component of Oracle MySQL Cluster affecting versions 7.4.34, 7.5.24, 7.6.20 and 8.0.27 and prior. It is rated difficult to exploit and requires high privileges plus human interaction, but a successful attack can fully compromise the cluster. The record gives no root-cause detail beyond the component name.
Impact
An attacker who succeeds gains full takeover of MySQL Cluster, with high confidentiality, integrity and availability impact.
Attack surface
Reached from the physical communication segment adjacent to the cluster hardware (AV:A), requiring high privileges (PR:H) and interaction from another person (UI:R). No remote unauthenticated path is described.
Exploitation
Not listed in CISA KEV and no ransomware use documented, but EPSS is 0.78951 (99.57th percentile), indicating high predicted exploitation activity; reference tags are only vendor and third-party advisories.
What to do
- Apply the Oracle January 2022 Critical Patch Update for MySQL Cluster versions 7.4.34, 7.5.24, 7.6.20 and 8.0.27 and prior.
- Apply the NetApp advisory updates for OnCommand Insight and OnCommand Workflow Automation where affected.
- Restrict and monitor access to the physical communication segment where the cluster runs.
- Limit high-privilege accounts and require review of privileged actions on cluster nodes.
Detection
- Monitor cluster and host logs for unexpected privileged operations or configuration changes on MySQL Cluster nodes.
- Alert on anomalous traffic between nodes on the cluster communication segment.
- Audit changes to high-privilege accounts and track use of privileged cluster administration functions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20220121-0008/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujan2022.html | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-22-083/ | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20220121-0008/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujan2022.html | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-22-083/ | Third Party Advisory |
Track CVE-2022-21279 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-21279), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
