WaratekVRT Sign in

CVE-2022-21589 Oracle MySQL Server

Affected softwareOracle MySQL Server
Affected versions5.7.39 and prior, 8.0.16 and prior
Severity4.3 Medium CVSS 3.1
Fixed inOracle Critical Patch Update October 2022
Published18 Oct 2022
Updated17 Jun 2026

Description

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.39 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · earliest 2024-02-20.
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.1% chance in 30 days

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2022-21589 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation hub.dragos.com /hubfs/312-Year-in-Review/2023/Dragos-2023-Year-in-Review-Full-Report.pdf 2024-02-20

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle MySQL / Server: Security: Privileges (5.7.39 and prior, 8.0.16 and prior)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle MySQL Server: Security: Privileges 5.7.39 and prior, 8.0.16 and prior

Products and versions

3 products, 4 version entries
SourceVendorProductSchemeAffected versions
nvd netapp oncommand insight generic any version
nvd netapp oncommand workflow automation generic any version
nvd oracle mysql generic ≥ 5.7.0 and ≤ 5.7.39 · ≥ 8.0 and ≤ 8.0.16

References

URLTags
https://security.netapp.com/advisory/ntap-20221028-0013/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2022.html Patch, Vendor Advisory

Timeline
Published2022-10-18By the CVE Program.
VulnCheck KEV: earliest evidence2024-02-20Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.