CVE-2024-21262 in MySQL Connectors
Summary
by MITRE • 10/16/2024
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions that are affected are 9.0.0 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/21/2026
The vulnerability identified as CVE-2024-21262 resides within Oracle MySQL's Connector/ODBC component, representing a critical security weakness that affects versions 9.0.0 and earlier. This flaw manifests as an easily exploitable vulnerability that permits unauthenticated attackers to gain network access and compromise the MySQL Connectors system. The vulnerability operates through multiple protocols, creating a broad attack surface that extends beyond traditional database connection methods. The security implications are significant as the flaw allows adversaries to manipulate data within the connectors and potentially disrupt service availability.
The technical nature of this vulnerability stems from insufficient authentication mechanisms within the Connector/ODBC component, enabling attackers to perform unauthorized operations without proper credentials. The CVSS score of 6.5 reflects the balanced impact across integrity and availability domains, indicating that while the attacker cannot directly access all data, they can modify or delete specific connector-related information. The attack vector requires only network access, making it particularly dangerous as it does not require elevated privileges or complex exploitation techniques. This weakness directly maps to CWE-287, which addresses authentication failures in software components, and aligns with ATT&CK technique T1190 for exploitation of remote services through network protocols.
The operational impact of this vulnerability extends beyond simple data manipulation to include partial denial of service conditions that can affect database connectivity and application functionality. Attackers can potentially cause disruptions that impact business continuity and data integrity within systems relying on MySQL Connectors for database access. The partial DOS capability means that while complete system shutdown is not guaranteed, service degradation can significantly impact application performance and user access. Organizations utilizing affected versions of MySQL Connectors face risks including unauthorized data modification, service disruption, and potential cascading failures in applications dependent on database connectivity. The vulnerability affects the broader MySQL ecosystem and demonstrates the importance of maintaining updated database connector components.
Mitigation strategies should prioritize immediate patching of affected systems to version 9.0.1 or later, which contains the necessary security fixes. Network segmentation and firewall rules should be implemented to limit access to MySQL Connectors only to authorized systems and users. Regular security assessments should include verification of connector component versions and configuration settings. Monitoring systems should be enhanced to detect unusual network activity patterns that might indicate exploitation attempts. Additionally, organizations should implement principle of least privilege access controls for database connections and maintain comprehensive audit logs for security event analysis. The vulnerability underscores the necessity of continuous security updates and the importance of vulnerability management programs that can quickly respond to emerging threats in database connectivity components.