Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).
Priority LOW 27Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors as well as unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01481 74th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Oracle | MySQL Connectors | up to 8.0.32 | — | No fix listed | CNA |
- MySQL Connectors VendorOracle Affected up to 8.0.32 Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.4.0:*:*:*:*:*:*:* | 22.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:23.1.0:*:*:*:*:*:*:* | 23.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.4.0:*:*:*:*:*:*:* | 22.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:23.1.0:*:*:*:*:*:*:* | 23.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* | 8.0.0 – 8.0.32 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.4.0:*:*:*:*:*:*:* Versions 22.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:23.1.0:*:*:*:*:*:*:* Versions 23.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.4.0:*:*:*:*:*:*:* Versions 22.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:23.1.0:*:*:*:*:*:*:* Versions 23.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.0.32 Vulnerable ·Oracle
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
Not affected: 10 products
- A-MQ Clients 2
- Red Hat Data Grid 8
- Red Hat Integration Camel K 1
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Application Runtimes
- Red Hat Single Sign-On 7
- Red Hat build of Debezium 1
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2023-21971
- 2026-10-03 Alias added: GHSA-8273-q4gg-6jm9
References
More Oracle Communications Cloud Native Core Binding Support Function vulnerabilities
- TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07125 Code injection in Spring Cloud Gateway KEVCVSS 3.1CRITICAL 10.0
- TI-2021-16530 XStream is vulnerable to a Remote Command Execution attack KEVCVSS 3.1HIGH 8.5
- TI-2022-07360 The deprecated compatibility function clnt_create in the sunrpc module of the GNU C… CVSS 3.1CRITICAL 9.8
- TI-2021-05762 Use after free in https://github.com/curl/curl CVSS 3.1HIGH 8.1
- TI-2021-05807 Cleartext transmission of sensitive information in https://github.com/curl/curl CVSS 3.1HIGH 7.5
Sources
- CVE-2023-21971 · CVE Program
- CVE-2023-21971 · NVD
- FIRST EPSS
- GHSA-8273-q4gg-6jm9 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-21971 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences