PT-2022-2013 · Oracle+6 · Mysql Server+5

Patrick Star · Published 2021-11-08 · Updated 2023-05-30 · CVE-2022-21352

Positive Technologies (AI Summary)

CVSS v2.0

7.9

High

Base vector

AV:N/AC:M/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.26 and prior

Description The issue is related to insufficient input validation in the InnoDB component of MySQL Server, allowing a highly privileged attacker with network access via multiple protocols to compromise the server. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, as well as the ability to cause a hang or frequently repeatable crash of MySQL Server, leading to a complete denial of service.

Recommendations For versions 8.0.26 and prior, update to a version later than 8.0.26 to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2022:7119

ALT-PU-2021-3241

ALT-PU-2022-1100

ALT-PU-2022-2171

ALT-PU-2023-1912

AZL-7733

BDU:2022-01605

CESA-2022_7119

CVE-2022-21352

RHSA-2022:6518

RHSA-2022:7119

RHSA-2022_7119

RLSA-2022:7119

Affected Products

Alt Linux

Almalinux

Centos

Mysql Server

Red Hat

Rocky Linux

References · 363

• 🔥 https://github.com/drago-96/CVE-2022-0778 · Exploit
• 🔥 https://github.com/alcaparra/CVE-2022-1292 · Exploit
• 🔥 https://github.com/yywing/cve-2022-0778 · Exploit
• 🔥 https://github.com/jkakavas/CVE-2022-0778-POC · Exploit
• 🔥 https://github.com/und3sc0n0c1d0/CVE-2022-1292 · Exploit
• 🔥 https://github.com/rama291041610/CVE-2022-1292 · Exploit
• 🔥 https://github.com/li8u99/CVE-2022-1292 · Exploit
• 🔥 https://github.com/greek0x0/CVE-2022-1292 · Exploit
• https://osv.dev/vulnerability/AZL-7733 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01605 · Security Note
• https://oracle.com/security-alerts/cpujan2022.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21352 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21352 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21352 · Security Note
• https://osv.dev/vulnerability/ALSA-2022:7119 · Vendor Advisory