CVE-2017-3523
Improper Access Control in MySQL Connectors Java
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Record
CVE-2017-3523- CVSS 3.0
- 8.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Record
CVE-2017-3523- Updated
- 2026-11-02
EUVDEUVD-2022-2076 No score
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Record
EUVD-2022-2076- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2xxh-f8r3-hvvr
Improper Access Control in MySQL Connectors Java
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Record
GHSA-2xxh-f8r3-hvvr- CVSS 3.0
- 8.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-2xxh-f8r3-hvvr
Improper Access Control in MySQL Connectors Java
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Record
GHSA-2xxh-f8r3-hvvr- CVSS 3.0
- 8.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-3523
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Record
UBUNTU-CVE-2017-3523- CVSS 3.0
- 8.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0382 No score
Updated mysql-connector-java packages fix security vulnerabilities
Thijs Alkemade discovered that unexpected automatic deserialisation of Java objects in the MySQL Connector/J JDBC driver may result in the execution of arbitary code (CVE-2017-3523).
Two vulnerabilities have been found in the MySQL Connector/J JDBC driver (CVE-2017-3586, CVE-2017-3589).
- Record
MGASA-2017-0382- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11071-1 No score
mysql-connector-java-8.0.25-2.2 on GA media
These are all security issues fixed in the mysql-connector-java-8.0.25-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11071-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2591-1 No score
Security update for mysql-connector-java
This update for mysql-connector-java to version to 5.1.42 fixes several issues.
These security issues were fixed:
- CVE-2017-3589: An unspecified vulnerability in MySQL Connector/J could have resulted in unauthorized update, insert or delete access to some of MySQL Connectors accessible data (bnc#1035210)
- CVE-2017-3523: An unspecified vulnerability in MySQL Connector/J could have lead to takeover of MySQL Connectors (bnc#1035697)
- CVE-2017-3586: An unspecified vulnerability in MySQL Connectors could have lead to unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data (bnc#1035211)
More infos are available at http://dev.mysql.com/doc/relnotes/connector-j/en/news-5-1.html
- Record
SUSE-SU-2017:2591-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mysql:mysql-connector-javaMaven |
through 5.1.40 | 5.1.41 |
mysql-connector-javaDebian:7 |
before 5.1.42-1~deb7u1, plus listed versions 5.1.16-25.1.25-15.1.26-15.1.27-15.1.28-1 Show 12 moreShow less5.1.29-15.1.30-15.1.31-15.1.32-15.1.37-15.1.38-15.1.39-15.1.39-1~deb7u15.1.39-1~deb8u15.1.40-15.1.41-15.1.41-1~deb8u1 |
5.1.42-1~deb7u1 |
mysql-connector-javaDebian:8 |
before 5.1.41-1~deb8u1, plus listed versions 5.1.32-15.1.37-15.1.38-15.1.39-15.1.39-1~deb7u15.1.39-1~deb8u15.1.40-1 |
5.1.41-1~deb8u1 |
mysql:mysql-connector-javaMaven |
before 5.1.41, plus listed versions 2.0.143.0.103.0.83.1.113.1.12 Show 45 moreShow less3.1.133.1.145.0.25.0.35.0.45.0.55.0.75.0.85.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.235.1.245.1.255.1.265.1.275.1.285.1.295.1.35.1.305.1.315.1.325.1.335.1.345.1.355.1.365.1.375.1.385.1.395.1.45.1.405.1.55.1.6 |
5.1.41 |
mysql-connector-javaMageia:5 |
before 5.1.42-1.mga5 | 5.1.42-1.mga5 |
mysql-connector-javaMageia:6 |
before 5.1.42-1.mga6 | 5.1.42-1.mga6 |
mysql-connector-javaSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 5.1.42-5.4.1 | 5.1.42-5.4.1 |
mysql-connector-javaSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 5.1.42-5.4.1 | 5.1.42-5.4.1 |
mysql-connector-javaUbuntu:14.04:LTS |
All versions, plus listed versions 5.1.25-15.1.26-15.1.27-15.1.28-1 |
None known |
mysql-connector-javaUbuntu:16.04:LTS |
All versions, plus listed versions 5.1.32-15.1.38-1 |
None known |
mysql-connector-javaopenSUSE:Tumbleweed |
before 8.0.25-2.2 | 8.0.25-2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-3523 is a high vulnerability (CVSS 8.5) in Oracle Corporation Mysql Connectors, published April 24, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.88%, the 86th percentile. Fixed in mysql:mysql-connector-java 5.1.41.
References
oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
securityfocus.com/bid/97982
debian.org/security/2017/dsa-3840
nvd.nist.gov/vuln/detail/CVE-2017-3523
github.com/advisories/GHSA-2xxh-f8r3-hvvr
advisories.mageia.org/MGASA-2017-0382.html
Show 13 moreShow less
bugs.mageia.org/show_bug.cgi?id=20731
computest.nl/advisories/CT-2017-0425_MySQL-Connector-J.txt
suse.com/support/update/announcement/2017/suse-su-20172591-1
bugzilla.suse.com/1035210
ubuntu.com/security/CVE-2017-3523
cve.org/CVERecord?id=CVE-2017-3523
Left out here: 2 versions. The JSON record has them.