Vulnerability record · CVE-2022-21490 · published 19 April 2022
CVE-2022-21490: Oracle MySQL Cluster flaw allows takeover via adjacent network
Oracle · Mysql Cluster
A vulnerability in the Cluster: General component of Oracle MySQL Cluster affects versions 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior, and 8.0.28 and prior. It is difficult to exploit and requires a high-privileged attacker with access to the physical communication segment plus human interaction by another person, but a successful attack can result in takeover of MySQL Cluster. The record gives no root-cause detail (CWE is NVD-CWE-noinfo), so the exact mechanism is unknown.
Description
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Automated analysis
medium priorityCVSS is 6.3 medium and exploitation requires adjacent access, high privileges and user interaction, though the impact is full cluster takeover and EPSS is very high.
What it is
A vulnerability in the Cluster: General component of Oracle MySQL Cluster affects versions 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior, and 8.0.28 and prior. It is difficult to exploit and requires a high-privileged attacker with access to the physical communication segment plus human interaction by another person, but a successful attack can result in takeover of MySQL Cluster. The record gives no root-cause detail (CWE is NVD-CWE-noinfo), so the exact mechanism is unknown.
Impact
An attacker who succeeds gains full compromise of MySQL Cluster, with high confidentiality, integrity and availability impact. That means potential read and modification of cluster data and disruption of the cluster service.
Attack surface
Reached over the adjacent network (AV:A) from the physical communication segment attached to the MySQL Cluster hardware. It requires high privileges (PR:H) and human interaction from a person other than the attacker (UI:R), so it is not remotely unauthenticated.
Exploitation
Not listed in CISA KEV and no ransomware use is documented; EPSS is high (0.78666, 99.6th percentile), but the only references are vendor and third-party advisories with no public exploit tag.
What to do
- Apply the Oracle April 2022 Critical Patch Update for MySQL Cluster and the corresponding NetApp advisories for affected products.
- Restrict network access to the cluster's physical communication segment to trusted, high-privileged hosts only.
- Reduce the number of accounts with high privileges on MySQL Cluster and review who can reach the cluster interconnect.
- Treat the human-interaction requirement as a social-engineering risk: train operators not to act on unsolicited requests touching cluster hosts.
- If patching is delayed, isolate the cluster interconnect from general user networks.
Detection
- Monitor cluster interconnect traffic for unexpected hosts or unusual connection patterns on the MySQL Cluster communication segment.
- Alert on new or changed high-privilege accounts and on administrative actions on cluster nodes outside change windows.
- Correlate operator activity with cluster node events to catch interaction-driven exploitation attempts.
- Watch for cluster service restarts, node evictions or data changes inconsistent with normal operations.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20220429-0005/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuapr2022.html | Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20220429-0005/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuapr2022.html | Vendor Advisory |
Track CVE-2022-21490 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-21490), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.
