Published: 20/10/2021 Updated: 28/04/2022

CVSS v2 Base Score: 7.9 | Impact Score: 9.2 | Exploitability Score: 6.8

CVSS v3 Base Score: 5.9 | Impact Score: 5.2 | Exploitability Score: 0.7

VMScore: 704

Vector: AV:N/AC:M/Au:S/C:C/I:N/A:C

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H).

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle communications cloud native core security edge protection proxy 1.7.0
oracle mysql connectors
oracle communications cloud native core console 1.9.0
oracle communications cloud native core policy 1.15.0
oracle communications cloud native core network slice selection function 1.8.0
quarkus quarkus

Synopsis Moderate: Red Hat Integration Camel-K 18 security update Type/Severity Security Advisory: Moderate Topic A minor version update is now available for Red Hat Integration Camel K The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security has rated this update as havi ...

Synopsis Moderate: Red Hat build of Quarkus 225 release and security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat build of QuarkusRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a det ...

Synopsis Moderate: Red Hat Integration Camel Extensions for Quarkus 221 security update Type/Severity Security Advisory: Moderate Topic A security update to Red Hat Integration Camel Extensions for Quarkus 22 is now available The purpose of this text-only errata is to inform you about the security issues fixedRed Hat Product Security has ...

Synopsis Moderate: Red Hat Process Automation Manager 7130 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat Process Automation ManagerRed Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) base score, which gives a ...

Synopsis Important: Red Hat Fuse 7110 release and security update Type/Severity Security Advisory: Important Topic A minor version update (from 710 to 711) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security has rated this update ...

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J) Supported versions that are affected are 8026 and prior Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors Successful attacks of this vulnerability can result in unauth ...

PoC for CVE-2021-2471 - XXE in MySQL Connector/J

CVE-2021-2471 - XXE in MySQL Connector/J Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J) Supported versions that are affected are 8026 and prior Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang

CVE-2021-2471 maven环境复现过程here 参考环境：githubcom/SecCoder-Security-Lab/jdbc-sqlxml-xxe

h2-jdbc(https://github.com/h2database/h2database/issues/3195) & mysql-jdbc(CVE-2021-2471) SQLXML XXE vulnerability reproduction.

jdbc-sqlxml-xxe h2-jdbc (CVE-2021-23463) (h2database/h2database#3195) SQLXML XXE vulnerability reproduction mysql-jdbc (CVE-2021-2471) SQLXML XXE vulnerability reproduction

NVD-CWE-noinfo https://www.oracle.com/security-alerts/cpuoct2021.html https://www.oracle.com/security-alerts/cpuapr2022.html https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2022:6407 https://github.com/DrunkenShells/CVE-2021-2471

CVE-2021-2471

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect