CVE-2024-21247

What it actually does

A flaw in the MySQL Client mysqldump component allows a high-privileged network attacker to perform unauthorized updates, inserts, deletes, and reads against accessible data.

Why it matters to the business

Attackers may alter or view subsets of database information, risking data integrity problems and compliance exposure; the issue affects widely used MySQL versions but shows low exploitation likelihood and stable low EPSS.

How an attack unfolds

An attacker with high privileges obtains network access and leverages multiple protocols against the mysqldump component in affected MySQL Client versions to achieve unauthorized data modification and disclosure.

How to fix it

Upgrade MySQL Client to versions after 8.0.39, 8.4.2, and 9.0.1; for the azure-vm-agents plugin, update to 853.v4a.

How to confirm the fix worked

Confirm MySQL Client versions exceed the affected ranges, verify plugin reaches 853.v4a, and test mysqldump operations under privileged accounts.

Typical attack path

1. Obtain high-privileged network credentials
2. Establish connection to MySQL Client via supported protocols
3. Trigger the mysqldump component vulnerability
4. Execute unauthorized data updates, inserts, deletes, or reads

How to detect it

Examine database and client logs for unexpected mysqldump invocations or data changes by privileged accounts; correlate with network connection records to MySQL ports.

What your security team should do

• Apply fixed versions immediately given the 729 days since publication
• Restrict high-privileged network access to MySQL instances
• Review database audit logs for anomalous data operations
• Monitor EPSS trend for any future increase