Vulnerability record · CVE-2022-21489 · published 19 April 2022
CVE-2022-21489: Oracle MySQL Cluster flaw allows takeover via adjacent network
Oracle · Mysql
CVE-2022-21489 is a vulnerability in the Cluster: General component of Oracle MySQL Cluster affecting versions 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior, and 8.0.28 and prior. It is difficult to exploit and requires a high-privileged attacker with access to the physical communication segment attached to the MySQL Cluster hardware, plus human interaction from another person. Successful exploitation can result in takeover of MySQL Cluster.
Description
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Automated analysis
medium priorityCVSS 3.1 base score is 6.3 (Medium) and exploitation requires adjacent access, high privileges, and human interaction, though the impact is full cluster takeover.
What it is
CVE-2022-21489 is a vulnerability in the Cluster: General component of Oracle MySQL Cluster affecting versions 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior, and 8.0.28 and prior. It is difficult to exploit and requires a high-privileged attacker with access to the physical communication segment attached to the MySQL Cluster hardware, plus human interaction from another person. Successful exploitation can result in takeover of MySQL Cluster.
Impact
An attacker who meets the access and privilege preconditions can fully compromise MySQL Cluster, affecting confidentiality, integrity, and availability. The result is takeover of the cluster rather than a limited data exposure.
Attack surface
Reached over the adjacent network segment attached to the hardware running MySQL Cluster, per the AV:A vector. It requires high privileges (PR:H) and human interaction from a person other than the attacker (UI:R), so it is not remotely exploitable without preconditions.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.78854, 99.57th percentile), but references are only vendor and third-party advisories with no public exploit tag.
What to do
- Apply the Oracle April 2022 Critical Patch Update for MySQL Cluster, upgrading past 7.4.35, 7.5.25, 7.6.21, and 8.0.28.
- Apply the NetApp advisory fixes for affected Active IQ Unified Manager, OnCommand Insight, and SnapCenter products.
- Restrict physical and network access to the MySQL Cluster communication segment to trusted, high-privileged personnel.
- Reduce the number of accounts with high privileges on MySQL Cluster and monitor for unexpected privileged activity.
- Treat human interaction paths (such as operator actions on cluster hosts) as a control point and reinforce change and access procedures.
Detection
- Monitor MySQL Cluster logs and host logs for unexpected privileged operations or configuration changes on cluster nodes.
- Alert on anomalous traffic or new connections on the physical communication segment used by MySQL Cluster.
- Audit high-privileged account activity and correlate it with cluster management actions for signs of takeover attempts.
- Track asset inventory for MySQL Cluster versions at or below 7.4.35, 7.5.25, 7.6.21, and 8.0.28 to confirm patching.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20220429-0005/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuapr2022.html | Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20220429-0005/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuapr2022.html | Vendor Advisory |
Track CVE-2022-21489 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-21489), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
