CVE-2022-21486: 
MySQL vulnerability analysis and mitigation

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General) affects versions 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior, and 8.0.28 and prior. This vulnerability was discovered by Lucas Leong (wmliang) of Trend Micro Zero Day Initiative and disclosed in Oracle's April 2022 Critical Patch Update (Oracle Advisory).

The vulnerability is difficult to exploit and requires a high-privileged attacker with access to the physical communication segment attached to the hardware where MySQL Cluster executes. The vulnerability has a CVSS 3.1 Base Score of 2.9 (Low severity) with Confidentiality and Availability impacts. The CVSS Vector is (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L) (NVD).

Successful exploitation of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster (Oracle Advisory).

The vulnerability requires human interaction from a person other than the attacker for successful exploitation. The attacker needs high privileges and physical access to the communication segment where MySQL Cluster runs, making it difficult to exploit in practice (NVD).

Oracle has released patches for affected versions as part of the April 2022 Critical Patch Update. Users should upgrade to the latest version of MySQL Cluster that includes these security fixes. NetApp products incorporating MySQL have also released patches for affected versions (NetApp Advisory).