CVE-2022-21555

Vulnerability in the MySQL Shell for VS Code product of Oracle MySQL (component: Shell: GUI). Supported versions that are affected are 1.1.8 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Shell for VS Code executes to compromise MySQL Shell for VS Code. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Shell for VS Code, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Shell for VS Code accessible data as well as unauthorized read access to a subset of MySQL Shell for VS Code accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N).

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.1 / Impact : 2.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujul2022.html	Patch Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2022.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:mysql_shell:*:*:*:*:*:visual_studio_code:*:*

History

21 Nov 2024, 06:44

Type	Values Removed	Values Added
References	~~() https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Vendor Advisory~~	() https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Vendor Advisory

25 Jul 2022, 18:58

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
References	~~(MISC) https://www.oracle.com/security-alerts/cpujul2022.html -~~	(MISC) https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Vendor Advisory
CPE		cpe:2.3:a:oracle:mysql_shell::::::visual_studio_code::*

19 Jul 2022, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-07-19 22:15

Updated : 2024-11-21 06:44

NVD link : CVE-2022-21555

Mitre link : CVE-2022-21555

CVE.ORG link : CVE-2022-21555

JSON object : View

Products Affected

oracle

mysql_shell

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-21555", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.1}]}, "published": "2022-07-19T22:15:12.463", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2022.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert_us@oracle.com"}, {"url": "https://www.oracle.com/security-alerts/cpujul2022.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the MySQL Shell for VS Code product of Oracle MySQL (component: Shell: GUI). Supported versions that are affected are 1.1.8 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Shell for VS Code executes to compromise MySQL Shell for VS Code. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Shell for VS Code, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Shell for VS Code accessible data as well as unauthorized read access to a subset of MySQL Shell for VS Code accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)."}, {"lang": "es", "value": "Una vulnerabilidad en el producto MySQL Shell for VS Code de Oracle MySQL (componente: Shell: GUI). Las versiones compatibles que est\u00e1n afectadas son 1.1.8 y anteriores. Una vulnerabilidad explotable f\u00e1cilmente permite a un atacante muy privilegiado y con acceso a la infraestructura donde es ejecutado MySQL Shell for VS Code comprometer MySQL Shell for VS Code. Los ataques con \u00e9xito requieren una interacci\u00f3n humana de una persona diferente del atacante y mientras la vulnerabilidad est\u00e1 en MySQL Shell para VS Code, los ataques pueden impactar significativamente en productos adicionales (cambio de alcance). Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en el acceso no autorizado de actualizaci\u00f3n, inserci\u00f3n o eliminaci\u00f3n de algunos de los datos accesibles de MySQL Shell para VS Code, as\u00ed como el acceso no autorizado de lectura a un subconjunto de datos accesibles de MySQL Shell para VS Code. CVSS 3.1, Puntuaci\u00f3n Base 4.2 (impactos en la Confidencialidad y la Integridad). Vector CVSS: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)."}], "lastModified": "2024-11-21T06:44:56.893", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:mysql_shell:*:*:*:*:*:visual_studio_code:*:*", "vulnerable": true, "matchCriteriaId": "38BF6087-B921-44FB-A3F9-B49911A874E4", "versionEndIncluding": "1.1.8"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}