Vulnerability · Published Oct 20, 2021 · Assigned by oracle

CVE-2021-2471

Medium 5.9

In plain English

A medium-severity security flaw in MySQL Connectors from Oracle Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.5% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)7.5%top 5.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H).

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	mysql:mysql-connector-java	8.0.27	GHSA-w6f2-8wx4-47r5
Ubuntu:22.04:LTS	mysql-8.0	8.0.27-0ubuntu0.21.10.1	UBUNTU-CVE-2021-2471

Affected products (as reported)

Vendor	Product	Versions
Oracle Corporation	MySQL Connectors	8.0.26 and prior

References

https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC