Incorrect authorization in Oracle MySQL Connectors
Priority LOW 37CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Partial Red Hat: 5 fixed, 12 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07493 94th percentileScored 2026-11-08
Fix Partial mysql:mysql-connector-java (Maven): 8.0.27Red Hat: 5 advisoriesRed Hat: 5 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Oracle | MySQL Connectors | up to 8.0.26 | — | No fix listed | CNA |
| — | mysql:mysql-connector-java (Maven) | 8.0.0 to before 8.0.27 | 8.0.27 | Patch available | GHSA-w6f2-8wx4-47r5 |
- MySQL Connectors VendorOracle Affected up to 8.0.26 Fixed in — No fix listed CNA
- mysql:mysql-connector-java (Maven) Vendor— Affected 8.0.0 to before 8.0.27 Fixed in 8.0.27 Patch available GHSA-w6f2-8wx4-47r5
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* | 1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* | 1.8.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* | 1.15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:* | 1.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* | 8.0.0 – 8.0.26 | Vulnerable | Oracle |
| cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* | before 2.2.4; 2.3.0 to before 2.6.0 | Vulnerable | quarkusio |
- cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.0.26 Vulnerable ·Oracle
- cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 2.2.4; 2.3.0 to before 2.6.0 Vulnerable ·quarkusio
Remediation
- Fix · GHSA-w6f2-8wx4-47r5 mysql:mysql-connector-java (Maven) Fixed in 8.0.27 Advisory →
Red Hat 5 advisories
- RHSA-2022:6407 Released 2022-09-09 · Red Hat rating ModerateRed Hat Integration Camel-K 1.8 security update
- RHAF Camel-K 1.8
- RHSA-2022:5903 Released 2022-08-04 · Red Hat rating ModerateRed Hat Process Automation Manager 7.13.0 security update
- RHPAM 7.13.0 async
- RHSA-2022:5532 Released 2022-07-07 · Red Hat rating ImportantRed Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11
Show 2 more Red Hat advisories
- RHSA-2022:1013 Released 2022-03-22 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus 2.2.1 security update
- RHINT Camel-Q 2.2.1
- RHSA-2022:0589 Released 2022-02-21 · Red Hat rating ModerateRed Hat build of Quarkus 2.2.5 release and security update
- Red Hat build of Quarkus 2.2.5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 1 | Affected | No fix yet |
| Red Hat build of Quarkus | Affected | No fix yet |
| RHAF Camel-K 1.8 | Fixed | RHSA-2022:6407 |
| RHINT Camel-Q 2.2.1 | Fixed | RHSA-2022:1013 |
| RHPAM 7.13.0 async | Fixed | RHSA-2022:5903 |
| Red Hat Fuse 7.11 | Fixed | RHSA-2022:5532 |
| Red Hat build of Quarkus 2.2.5 | Fixed | RHSA-2022:0589 |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-2471
- 2026-10-03 Alias added: GHSA-w6f2-8wx4-47r5
References
More Oracle Communications Cloud Native Core Console vulnerabilities
- TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07140 Code injection in Spring Cloud Function KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07125 Code injection in Spring Cloud Gateway KEVCVSS 3.1CRITICAL 10.0
- TI-2022-07362 H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a… CVSS 3.1CRITICAL 9.8
- TI-2021-20437 Apache Log4j2 does not always protect from infinite recursion in lookup evaluation CVSS 3.1MEDIUM 5.9
- TI-2021-05807 Cleartext transmission of sensitive information in https://github.com/curl/curl CVSS 3.1HIGH 7.5
Sources
- CVE-2021-2471 · CVE Program
- CVE-2021-2471 · NVD
- FIRST EPSS
- GHSA-w6f2-8wx4-47r5 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-2471 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences