CVE-2022-21490

What it actually does

This vulnerability affects Oracle MySQL Cluster, specifically the Cluster: General component, in supported versions 7.4.35 and earlier, 7.5.25 and earlier, 7.6.21 and earlier, and 8.0.28 and earlier. A highly privileged attacker who already has access to the physical or local communication segment used by the MySQL Cluster can exploit the flaw, but exploitation is difficult and requires interaction from another person. Successful exploitation can allow complete takeover of the MySQL Cluster, with high confidentiality, integrity, and availability impact, meaning the attacker may be able to read, alter, disrupt, or control clustered database operations.

Why it matters to the business

A successful attack could result in loss of control over a MySQL Cluster environment, potentially exposing sensitive data, corrupting business-critical records, or interrupting services that depend on clustered MySQL availability. The attack requirements are restrictive because the attacker needs high privileges, adjacency to the cluster communication segment, and user interaction, but the EPSS score is high enough to justify prioritizing remediation where MySQL Cluster is deployed, especially in environments using downstream products such as NetApp Active IQ Unified Manager, NetApp OnCommand Insight, or NetApp SnapCenter that may bundle or depend on affected components.

How an attack unfolds

An attacker would first need to obtain high-privilege access in or near the environment where MySQL Cluster traffic is carried, such as access to the physical or local network segment used by cluster nodes. The attacker would then position themselves to interact with or influence cluster communications or administrative workflows. Because exploitation requires user interaction, the attacker would likely need an administrator or other user to perform an action that triggers the vulnerable code path, such as interacting with cluster tooling, services, or configuration in a way that processes attacker-influenced data. If the exploit succeeds, the attacker can compromise the MySQL Cluster and potentially take over clustered database operations, affecting data confidentiality, data integrity, and service availability.

How to fix it

Upgrade Oracle MySQL Cluster to a vendor-supported release that includes the April 2022 Oracle Critical Patch Update or a later security update. Specifically, do not run MySQL Cluster 7.4.35 or earlier, 7.5.25 or earlier, 7.6.21 or earlier, or 8.0.28 or earlier. Where MySQL Cluster is embedded in or distributed with third-party products, apply the vendor-provided fixed release or security update for the affected product, including relevant NetApp advisories for Active IQ Unified Manager, OnCommand Insight, and SnapCenter. As compensating controls, restrict MySQL Cluster communication networks to only required cluster nodes, isolate cluster interconnect traffic from user-accessible networks, enforce strong administrative access controls, monitor and limit privileged access, and require change control for cluster configuration and management operations.

How to confirm the fix worked

Confirm all MySQL Cluster components, including management nodes, data nodes, SQL nodes, client utilities, and packaged third-party deployments, are running versions later than the affected version ranges or have received the relevant vendor security update. Validate the installed version with MySQL Cluster and package-management commands, review vendor build metadata for bundled products, and compare results against Oracle and downstream vendor advisories. Confirm network segmentation by verifying that only authorized cluster nodes and administrative hosts can reach cluster communication ports and management services. After patching, perform a controlled restart or rolling upgrade validation according to Oracle guidance, confirm cluster health, and review logs for abnormal management operations, unexpected node joins, or unauthorized privileged access attempts.

Typical attack path

1. Gain or already possess high-privilege access to systems or infrastructure connected to the MySQL Cluster communication segment.
2. Identify MySQL Cluster nodes, management services, versions, and administrative workflows.
3. Position on the adjacent physical or local network segment used by cluster communications.
4. Induce or wait for required human interaction by an administrator or user with cluster-related tooling or services.
5. Trigger the vulnerable Cluster: General component behavior in an affected MySQL Cluster version.
6. Leverage successful exploitation to take control of the MySQL Cluster or manipulate clustered database operations.
7. Maintain access, alter data, exfiltrate sensitive information, or disrupt database availability.

How to detect it

There are no public, CVE-specific indicators provided for this vulnerability, so detection should focus on suspicious behavior around MySQL Cluster administration and the cluster communication network. Review MySQL Cluster management node logs, data node logs, SQL node logs, operating-system authentication logs, sudo or privilege-escalation logs, network device logs, switch port telemetry, and endpoint telemetry from cluster hosts. Look for unexpected cluster node joins or removals, unexplained management commands, unauthorized configuration changes, abnormal restarts of ndb_mgmd, ndbd, ndbmtd, or mysqld processes, privileged logins from unusual hosts, and traffic to cluster management or data-node services from systems that are not approved cluster members. Because exploitation requires human interaction, correlate suspicious cluster events with administrative sessions, helpdesk activity, remote access sessions, file transfers, or configuration changes performed shortly before the event. For bundled deployments, also review application and appliance logs from affected downstream products for unexpected service restarts, upgrade failures, abnormal database errors, or unauthorized administrative access.

What your security team should do

• Inventory all Oracle MySQL Cluster deployments and downstream products that may include MySQL Cluster components, including NetApp Active IQ Unified Manager, NetApp OnCommand Insight, and NetApp SnapCenter.
• Prioritize patching internet-adjacent or broadly reachable administrative environments first, even though exploitation requires adjacent access, because the EPSS score indicates elevated likelihood of exploitation activity over time.
• Upgrade affected MySQL Cluster versions to a vendor-supported fixed release or apply the applicable Oracle Critical Patch Update or downstream vendor update.
• Restrict access to the MySQL Cluster physical and logical communication segment to only required nodes and trusted administrative systems.
• Review privileged accounts and administrative access paths for MySQL Cluster and remove unnecessary access.
• Increase monitoring of MySQL Cluster management logs, node membership events, administrative actions, and operating-system authentication logs around cluster hosts.
• Hunt for signs of unusual cluster reconfiguration, unexpected node activity, unexplained restarts, abnormal privilege use, or unauthorized access from systems on the cluster network segment.
• Ensure backups are current, offline or immutable where possible, and tested for restoration in case cluster integrity is affected.