CVE-2024-21101 in MySQL NDB Cluster
Summary
by MITRE • 04/17/2024
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.33 and prior, 7.6.29 and prior, 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/07/2025
The vulnerability identified as CVE-2024-21101 represents a significant security weakness within Oracle MySQL Cluster components that affects multiple version ranges including 7.5.33 and earlier, 7.6.29 and earlier, 8.0.36 and earlier, and 8.3.0 and earlier releases. This issue resides within the Cluster: General component of the MySQL Cluster product line, which serves as the foundational architecture for distributed database operations. The vulnerability's classification as difficult to exploit indicates that while the attack vector is not trivial, it remains a genuine threat to database security infrastructure. The CVSS 3.1 scoring system assigns a base score of 2.2, reflecting the relatively low severity but significant confidentiality impact that this flaw represents for database environments.
The technical nature of this vulnerability stems from insufficient access controls within the MySQL Cluster's authentication and authorization mechanisms. Attackers with high privileged access and network connectivity through multiple protocols can potentially exploit this weakness to gain unauthorized read access to specific subsets of data within the cluster. This particular flaw does not grant full system compromise or write privileges, but rather focuses on data confidentiality breaches that could expose sensitive information stored within the database cluster. The vulnerability's impact is specifically targeted toward data exposure rather than system disruption or privilege escalation to administrative levels, though the confidentiality breach remains concerning for environments handling sensitive data.
The operational implications of this vulnerability extend beyond simple data exposure concerns, as it could potentially compromise the integrity of database operations within MySQL Cluster environments. Organizations running affected versions of MySQL Cluster may face unauthorized data access incidents that could lead to regulatory compliance violations, particularly in industries governed by data protection regulations such as healthcare, finance, or government sectors. The vulnerability's network-based exploitation vector means that attackers do not require physical access to the systems, making it particularly dangerous in cloud environments or distributed database architectures where network exposure is common. Security teams must consider the potential for data leakage from clusters that may contain personally identifiable information, financial records, or other sensitive business data.
Mitigation strategies for CVE-2024-21101 should prioritize immediate version upgrades to patched releases of MySQL Cluster, particularly focusing on the affected version ranges mentioned in the vulnerability description. Organizations should implement network segmentation and access controls to limit exposure of MySQL Cluster components to unauthorized network traffic, though this approach provides only partial protection given the high privileged access requirement. The vulnerability's CVSS vector indicates that the attack requires high privileges and network access, suggesting that proper access control implementation and privilege management could significantly reduce exploitability. Security monitoring should include detection of unusual network traffic patterns or unauthorized access attempts to MySQL Cluster components, aligning with ATT&CK framework techniques related to credential access and data extraction. Additionally, organizations should conduct comprehensive vulnerability assessments to identify all instances of affected MySQL Cluster versions within their infrastructure and implement appropriate network controls to minimize attack surface exposure. This vulnerability demonstrates the importance of maintaining up-to-date database software versions and implementing robust access control policies as recommended by CWE categories related to insufficient access control and weak access control mechanisms.