CVE-2022-21315: 
MySQL vulnerability analysis and mitigation

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General) identified as CVE-2022-21315. The vulnerability affects versions 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior, and 8.0.27 and prior. This is a difficult-to-exploit vulnerability that requires high privileges and physical access to the communication segment where MySQL Cluster executes (Oracle Advisory).

The vulnerability has a CVSS 3.1 Base Score of 6.3 (Medium) with the vector string CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H. The attack requires adjacent network access, high attack complexity, high privileges, and user interaction. The scope is unchanged, with potential high impacts on confidentiality, integrity, and availability (ZDI Advisory).

Successful exploitation of this vulnerability can result in complete takeover of MySQL Cluster. The vulnerability affects all three security properties - confidentiality, integrity, and availability - with potential high impact on each (NetApp Advisory).

Oracle has issued updates to correct this vulnerability in their January 2022 Critical Patch Update. Users should upgrade to versions newer than 7.4.34, 7.5.24, 7.6.20, or 8.0.27 depending on their current version track (ZDI Advisory).