CVE-2024-21101: 
MySQL vulnerability analysis and mitigation

CVE-2024-21101 is a vulnerability discovered in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). The affected versions include MySQL Cluster 7.5.33 and prior, 7.6.29 and prior, 8.0.36 and prior, and 8.3.0 and prior. This vulnerability was disclosed in Oracle's April 2024 Critical Patch Update (Oracle CPU).

The vulnerability is classified as difficult to exploit and requires a high-privileged attacker with network access via multiple protocols to compromise MySQL Cluster. It has been assigned a CVSS 3.1 Base Score of 2.2 (Low severity) with the following vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N. This indicates network attack vector, high attack complexity, high privileges required, no user interaction needed, unchanged scope, and low confidentiality impact (Oracle CPU, NVD).

Successful exploitation of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data. The impact is limited to confidentiality, with no effects on integrity or availability of the system (Oracle CPU, NetApp Advisory).

The vulnerability is characterized as difficult to exploit, requiring an attacker to have high privileges and network access through multiple protocols. The high attack complexity and privilege requirements serve as natural barriers to exploitation (Oracle CPU).

Oracle has released patches for this vulnerability as part of their April 2024 Critical Patch Update. Organizations using affected versions of MySQL Cluster should upgrade to the patched versions. Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible (Oracle CPU).