GHSA-w6f2-8wx4-47r5 · Severity: medium · Ecosystem: maven — Incorrect Authorization in MySQL Connector Java
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H).
Conclusion & alert: CVE-2021-2471 is rated Moderate Risk (56.7/100): CVSS Medium severity, with high exploitation likelihood (EPSS 63.82%, 98th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-21 | 65.14% | 63.82% | -1.31% |
| 2 | 2025-12-28 | 62.70% | 65.14% | +2.44% |
| 3 | 2025-12-06 | — | 62.70% | — |
Full EPSS history (21 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.9 | 3.1 | MEDIUM |
|
0.7 | 5.2 | [email protected] |
| 7.9 | 2.0 | HIGH |
|
6.8 | 9.2 | [email protected] |
GHSA-w6f2-8wx4-47r5 · Severity: medium · Ecosystem: maven — Incorrect Authorization in MySQL Connector Java
| vendor | priority | summary | link |
|---|---|---|---|
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2021-2471 |
suse
|
medium | — | https://www.suse.com/security/cve/CVE-2021-2471/ |
ubuntu
|
medium | CVE-2021-2471 medium priority: Ubuntu including 12 source packages (mariadb-10.0, mariadb-10.1, …), 173 status rows across 16 suites (bionic, focal, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, vivid, xenial): DNE 142, not-affected 11, released 10, needs-triage 7, ignored 3. | https://ubuntu.com/security/CVE-2021-2471 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| oracle | communications_cloud_native_core_console | 1.9.0 | cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* |
| oracle | communications_cloud_native_core_network_slice_selection_function | 1.8.0 | cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* |
| oracle | communications_cloud_native_core_policy | 1.15.0 | cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* |
| oracle | communications_cloud_native_core_security_edge_protection_proxy | 1.7.0 | cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:* |
| oracle | mysql_connectors | >= 8.0.0, <= 8.0.26 | cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* |
| quarkus | quarkus | < 2.2.4 | cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* |
| quarkus | quarkus | >= 2.3.0, < 2.6.0 | cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* |
| URL | Tags |
|---|---|
| https://www.oracle.com/security-alerts/cpuapr2022.html | Vendor Advisory |
| https://www.oracle.com/security-alerts/cpuoct2021.html | Vendor Advisory |