Vulnerability record · CVE-2022-21280 · published 19 January 2022
CVE-2022-21280: Oracle MySQL Cluster flaw allows takeover by adjacent high-privileged attacker
Oracle · Mysql
Oracle MySQL Cluster contains a vulnerability in the Cluster: General component affecting versions 7.4.34, 7.5.24, 7.6.20 and 8.0.27 and prior. The flaw is difficult to exploit and requires a high-privileged attacker on the same physical communication segment plus human interaction from another person, but successful exploitation results in full takeover of MySQL Cluster. The record gives no CWE detail beyond insufficient information, so the exact root cause is unknown.
Description
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Automated analysis
medium priorityCVSS is 6.3 medium and exploitation requires adjacent access, high privileges and user interaction, though the impact is full cluster takeover and EPSS is very high.
What it is
Oracle MySQL Cluster contains a vulnerability in the Cluster: General component affecting versions 7.4.34, 7.5.24, 7.6.20 and 8.0.27 and prior. The flaw is difficult to exploit and requires a high-privileged attacker on the same physical communication segment plus human interaction from another person, but successful exploitation results in full takeover of MySQL Cluster. The record gives no CWE detail beyond insufficient information, so the exact root cause is unknown.
Impact
An attacker who meets the access and interaction preconditions gains complete compromise of the MySQL Cluster, affecting confidentiality, integrity and availability. This is a full takeover rather than a partial data exposure.
Attack surface
The vector is adjacent (AV:A), so the attacker must be on the physical communication segment attached to the MySQL Cluster hardware. Exploitation requires high privileges (PR:H) and human interaction from a person other than the attacker (UI:R), making it a narrow, non-remote path.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.76548, 99.5th percentile), but the references are only vendor and third-party advisories with no public exploit tag, so active exploitation is not confirmed.
What to do
- Apply the Oracle January 2022 Critical Patch Update fixes for MySQL Cluster and the corresponding NetApp advisories for OnCommand products.
- Restrict network access to the MySQL Cluster communication segment to trusted, high-privileged hosts only.
- Reduce the number of accounts with the high privileges required to reach the vulnerable component.
- Monitor and control physical or adjacent network access to cluster hardware.
- Track vendor advisories for updated fixed versions since the record does not list them.
Detection
- Monitor MySQL Cluster logs for unexpected administrative or cluster-management activity from adjacent hosts.
- Alert on anomalous connections to cluster communication ports from hosts outside the expected segment.
- Correlate high-privileged account activity with unusual cluster state changes or restarts.
- Review NetApp OnCommand Insight and Workflow Automation logs for signs of compromise if those products are in scope.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20220121-0008/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujan2022.html | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-22-084/ | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20220121-0008/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujan2022.html | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-22-084/ | Third Party Advisory |
Track CVE-2022-21280 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-21280), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
