CVE-2024-21101 - OpenCVE

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.33 and prior, 7.6.29 and prior, 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Oracle	Mysql Ndb Cluster

No data.

No data.

References

Link	Providers
https://security.netapp.com/advisory/ntap-20240426-0015/
https://www.oracle.com/security-alerts/cpuapr2024.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: oracle

Published: 2024-04-16T21:26:32.608Z

Updated: 2024-09-03T18:21:22.496Z

Reserved: 2023-12-07T22:28:10.675Z

Link: CVE-2024-21101

Vulnrichment

Updated: 2024-08-01T22:13:42.690Z

NVD

Status : Awaiting Analysis

Published: 2024-04-16T22:15:31.087

Modified: 2024-04-26T09:15:11.750

Link: CVE-2024-21101

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-21101", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2023-12-07T22:28:10.675Z", "datePublished": "2024-04-16T21:26:32.608Z", "dateUpdated": "2024-09-03T18:21:22.496Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2024-04-16T21:26:32.608Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "MySQL NDB Cluster", "cpes": ["cpe:2.3:a:oracle:mysql_ndb_cluster:7.5.33_and_prior:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:mysql_ndb_cluster:7.6.29_and_prior:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:mysql_ndb_cluster:8.0.36_and_prior:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:mysql_ndb_cluster:8.3.0_and_prior:*:*:*:*:*:*:*"], "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "7.5.33", "versionType": "custom"}, {"version": "*", "status": "affected", "lessThanOrEqual": "7.6.29", "versionType": "custom"}, {"version": "*", "status": "affected", "lessThanOrEqual": "8.0.36", "versionType": "custom"}, {"version": "*", "status": "affected", "lessThanOrEqual": "8.3.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.33 and prior, 7.6.29 and prior, 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2024.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}, {"url": "https://security.netapp.com/advisory/ntap-20240426-0015/"}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N", "baseScore": 2.2, "baseSeverity": "LOW"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:13:42.690Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2024.html", "name": "Oracle Advisory", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240426-0015/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-07T14:15:45.611592Z", "id": "CVE-2024-21101", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T18:21:22.496Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2024.html", "name": "Oracle Advisory", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240426-0015/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:13:42.690Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-21101", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-07T14:15:45.611592Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T18:21:19.193Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.2, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:2.3:a:oracle:mysql_ndb_cluster:7.5.33_and_prior:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:mysql_ndb_cluster:7.6.29_and_prior:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:mysql_ndb_cluster:8.0.36_and_prior:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:mysql_ndb_cluster:8.3.0_and_prior:*:*:*:*:*:*:*"], "vendor": "Oracle Corporation", "product": "MySQL NDB Cluster", "versions": [{"status": "affected", "version": "*", "versionType": "custom", "lessThanOrEqual": "7.5.33"}, {"status": "affected", "version": "*", "versionType": "custom", "lessThanOrEqual": "7.6.29"}, {"status": "affected", "version": "*", "versionType": "custom", "lessThanOrEqual": "8.0.36"}, {"status": "affected", "version": "*", "versionType": "custom", "lessThanOrEqual": "8.3.0"}]}], "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2024.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}, {"url": "https://security.netapp.com/advisory/ntap-20240426-0015/"}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.33 and prior, 7.6.29 and prior, 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N)."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data."}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2024-04-16T21:26:32.608Z"}}}, "cveMetadata": {"cveId": "CVE-2024-21101", "state": "PUBLISHED", "dateUpdated": "2024-09-03T18:21:22.496Z", "dateReserved": "2023-12-07T22:28:10.675Z", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "datePublished": "2024-04-16T21:26:32.608Z", "assignerShortName": "oracle"}, "dataVersion": "5.1"}