CVE-2021-2471

highpriority · attend · 45OT risk · highEPSS 0.075 · 94 %ileexploit · PoCDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

3 exploits · PoC

Likely / severe?

7.49% (94th) EPSS

CVSS 7.9 · high

Is it mine?

29 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · osv

EPSS · scored 2026-10-27

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H).

cvss

Technical severity, 0–10. One row per scoring source.

7.9

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.6–7.9

v2.07.9highAV:N/AC:M/Au:S/C:C/I:N/A:Cprimary · NVD / NIST USexploitability 6.8 · impact 9.2

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:Hsecondary · ENISA EU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:Hsecondary · secalert_us@oracle.com USexploitability 0.7 · impact 5.2

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:Hsecondary · OSV

v3.15.6mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-863US

exploits (3)

Public proof-of-concept and weaponised exploit code.

DrunkenShells/CVE-2021-2471PoC for CVE-2021-2471 - XXE in MySQL Connector/JPoC · poc_in_github
SecCoder-Security-Lab/jdbc-sqlxml-xxeh2-jdbc(https://github.com/h2database/h2database/issues/3195) & mysql-jdbc(CVE-2021-2471) SQLXML XXE vulnerability reproduction.PoC · poc_in_github
cckuailong/CVE-2021-2471cckuailong/CVE-2021-2471PoC · poc_in_github

affected products (29)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Dell ECS <3.8.1.0all versionscert_bundDE
Dell PowerEdgeall versionscert_bundDEcpe:/h:dell:poweredge:-
EMC Avamarall versionscert_bundDEcpe:/a:emc:avamar:-
Hitachi Ops Centerall versionscert_bundDEcpe:/a:hitachi:ops_center:-
IBM InfoSphere Information Serverall versionscert_bundDEcpe:/a:ibm:infosphere_information_server:-
IBM Operational Decision Managerall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:-
IBM QRadar SIEMall versionscert_bundDEcpe:/a:ibm:qradar_siem:-
IBM QRadar SIEM 7.4all versionscert_bundDEcpe:/a:ibm:qradar_siem:7.4
IBM QRadar SIEM 7.5all versionscert_bundDEcpe:/a:ibm:qradar_siem:7.5
IBM Spectrum Protect plus 10.1all versionscert_bundDEcpe:/a:ibm:spectrum_protect:plus_10.1
NetApp ActiveIQ Unified Managerall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Atlassian Bitbucket< 10.0.2cert_bundDE
Atlassian Bitbucket< 8.19.25 (LTS)cert_bundDE
Atlassian Bitbucket< 9.4.13 (LTS)cert_bundDE
Dell ECS< 3.8.1.0cert_bundDE
Red Hat Fuse< 7.11.0cert_bundDE
Red Hat JBoss Enterprise Application Platform< 7.1.10cert_bundDE
Red Hat JBoss Enterprise Application Platform< 7.3.13cert_bundDE

showing 20 of 29

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-0607Red Hat FUSE: Mehrere SchwachstellenDeutsch2022-07-07csaf · cert_bundDE
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, einen Denial of Service Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.
WID-SEC-W-2024-0794Dell ECS: Mehrere SchwachstellenDeutsch2024-04-04csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
GHSA-w6f2-8wx4-47r5Incorrect Authorization in MySQL Connector Java2022-05-24ghsa · osvUS
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H).

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund osv NVD CVE.org MITRE

published 2021-10-20modified 2026-06-17

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan