CVE-2023-21935 in MySQL Server
Summary
by MITRE • 04/18/2023
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/08/2025
The vulnerability identified as CVE-2023-21935 resides within the MySQL Server optimizer component of Oracle MySQL database systems. This flaw affects versions 8.0.32 and earlier, representing a significant security concern for database administrators and system operators. The vulnerability operates at the core optimization layer of the database server, where query execution plans are processed and executed. The affected component specifically handles the server's query optimization functionality, which is fundamental to database performance and operation. This type of vulnerability is particularly dangerous because it impacts the foundational query processing mechanisms that all database operations depend upon, creating a potential attack surface that could compromise entire database systems.
The technical nature of this vulnerability stems from improper handling within the MySQL Server optimizer module, where specific query patterns can trigger abnormal behavior in the database server's execution engine. Attackers with high privileges and network access can exploit this weakness through multiple network protocols, making the attack vector quite broad and accessible. The vulnerability's classification as easily exploitable indicates that the attack requires minimal technical skill or resources to execute successfully. The flaw manifests as a condition that can cause the MySQL Server to enter a state of indefinite hanging or experience frequent crashes that can be repeatedly triggered. This behavior results in a complete denial of service condition where legitimate database operations cannot proceed due to the server's unavailability.
The operational impact of CVE-2023-21935 is severe and directly affects the availability aspect of database systems according to the CVSS 3.1 scoring model. The vulnerability can cause complete database server downtime, effectively rendering all applications dependent on that database server inoperative. The availability impact score of 4.9 reflects the significant disruption potential, as this vulnerability can be repeatedly triggered to maintain persistent service disruption. Database administrators face the challenge of maintaining service availability while addressing this vulnerability, as the attack can be sustained to continuously impact database operations. The high privilege requirement for exploitation suggests that attackers must already have elevated access rights, but this does not mitigate the overall impact since compromised privileged accounts can cause substantial damage. The vulnerability's potential for complete system disruption makes it particularly concerning for mission-critical database environments where uptime is essential.
Mitigation strategies for this vulnerability primarily focus on immediate patching and system updates to the latest MySQL Server versions that contain fixes for this specific flaw. Organizations should prioritize updating their MySQL Server installations to versions beyond 8.0.32 to eliminate exposure to this vulnerability. Network segmentation and access controls should be implemented to limit the attack surface, particularly restricting network access to database servers from trusted sources only. Monitoring systems should be enhanced to detect unusual patterns of database server behavior or repeated connection failures that might indicate exploitation attempts. The vulnerability's classification under CWE-119, which deals with improper access to memory, indicates that the issue involves memory management problems within the optimizer component. From an ATT&CK framework perspective, this vulnerability could be categorized under T1499.004 for Network Denial of Service, as it enables attackers to maintain persistent disruption of database services. Regular security assessments and vulnerability scanning should be conducted to identify systems running vulnerable MySQL versions, and incident response procedures should be established to address potential exploitation attempts.