CVE-2017-3589
Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
- Record
CVE-2017-3589- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
- Record
CVE-2017-3589- Updated
- 2026-11-02
EUVDEUVD-2022-3587 No score
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
- Record
EUVD-2022-3587- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cjcf-wm2p-59h5
Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
- Record
GHSA-cjcf-wm2p-59h5- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-cjcf-wm2p-59h5
Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
- Record
GHSA-cjcf-wm2p-59h5- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-3589
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
- Record
UBUNTU-CVE-2017-3589- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2017-0382 No score
Updated mysql-connector-java packages fix security vulnerabilities
Thijs Alkemade discovered that unexpected automatic deserialisation of Java objects in the MySQL Connector/J JDBC driver may result in the execution of arbitary code (CVE-2017-3523).
Two vulnerabilities have been found in the MySQL Connector/J JDBC driver (CVE-2017-3586, CVE-2017-3589).
- Record
MGASA-2017-0382- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11071-1 No score
mysql-connector-java-8.0.25-2.2 on GA media
These are all security issues fixed in the mysql-connector-java-8.0.25-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11071-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2591-1 No score
Security update for mysql-connector-java
This update for mysql-connector-java to version to 5.1.42 fixes several issues.
These security issues were fixed:
- CVE-2017-3589: An unspecified vulnerability in MySQL Connector/J could have resulted in unauthorized update, insert or delete access to some of MySQL Connectors accessible data (bnc#1035210)
- CVE-2017-3523: An unspecified vulnerability in MySQL Connector/J could have lead to takeover of MySQL Connectors (bnc#1035697)
- CVE-2017-3586: An unspecified vulnerability in MySQL Connectors could have lead to unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data (bnc#1035211)
More infos are available at http://dev.mysql.com/doc/relnotes/connector-j/en/news-5-1.html
- Record
SUSE-SU-2017:2591-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mysql:mysql-connector-javaMaven |
through 5.1.41 | 5.1.42 |
mysql-connector-javaDebian:7 |
before 5.1.42-1~deb7u1, plus listed versions 5.1.16-25.1.25-15.1.26-15.1.27-15.1.28-1 Show 12 moreShow less5.1.29-15.1.30-15.1.31-15.1.32-15.1.37-15.1.38-15.1.39-15.1.39-1~deb7u15.1.39-1~deb8u15.1.40-15.1.41-15.1.41-1~deb8u1 |
5.1.42-1~deb7u1 |
mysql-connector-javaDebian:8 |
before 5.1.42-1~deb8u1, plus listed versions 5.1.32-15.1.37-15.1.38-15.1.39-15.1.39-1~deb7u1 Show 5 moreShow less5.1.39-1~deb8u15.1.40-15.1.41-15.1.41-1~deb8u15.1.42-1~deb7u1 |
5.1.42-1~deb8u1 |
mysql:mysql-connector-javaMaven |
before 5.1.42, plus listed versions 2.0.143.0.103.0.83.1.113.1.12 Show 45 moreShow less3.1.133.1.145.0.25.0.35.0.45.0.55.0.75.0.85.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.235.1.245.1.255.1.265.1.275.1.285.1.295.1.35.1.305.1.315.1.325.1.335.1.345.1.355.1.365.1.375.1.385.1.395.1.45.1.405.1.415.1.5 |
5.1.42 |
mysql-connector-javaMageia:5 |
before 5.1.42-1.mga5 | 5.1.42-1.mga5 |
mysql-connector-javaMageia:6 |
before 5.1.42-1.mga6 | 5.1.42-1.mga6 |
mysql-connector-javaSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 5.1.42-5.4.1 | 5.1.42-5.4.1 |
mysql-connector-javaSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 5.1.42-5.4.1 | 5.1.42-5.4.1 |
mysql-connector-javaUbuntu:14.04:LTS |
All versions, plus listed versions 5.1.25-15.1.26-15.1.27-15.1.28-1 |
None known |
mysql-connector-javaUbuntu:16.04:LTS |
All versions, plus listed versions 5.1.32-15.1.38-1 |
None known |
mysql-connector-javaopenSUSE:Tumbleweed |
before 8.0.25-2.2 | 8.0.25-2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-3589 is a low vulnerability (CVSS 3.3) in Oracle Corporation Mysql Connectors, published April 24, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in mysql:mysql-connector-java 5.1.42.
References
securityfocus.com/bid/97836
securitytracker.com/id/1038287
oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
debian.org/security/2017/dsa-3857
nvd.nist.gov/vuln/detail/CVE-2017-3589
github.com/advisories/GHSA-cjcf-wm2p-59h5
Show 14 moreShow less
advisories.mageia.org/MGASA-2017-0382.html
bugs.mageia.org/show_bug.cgi?id=20731
computest.nl/advisories/CT-2017-0425_MySQL-Connector-J.txt
suse.com/support/update/announcement/2017/suse-su-20172591-1
bugzilla.suse.com/1035210
ubuntu.com/security/CVE-2017-3589
cve.org/CVERecord?id=CVE-2017-3589
Left out here: 3 versions. The JSON record has them.