CVE-2017-3586
Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
- Record
CVE-2017-3586- CVSS 3.0
- 6.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
- Record
CVE-2017-3586- Updated
- 2026-11-02
EUVDEUVD-2022-4838 No score
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
- Record
EUVD-2022-4838- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pwh7-92h3-mqr6
Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
- Record
GHSA-pwh7-92h3-mqr6- CVSS 3.0
- 6.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-pwh7-92h3-mqr6
Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
- Record
GHSA-pwh7-92h3-mqr6- CVSS 3.0
- 6.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-3586
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
- Record
UBUNTU-CVE-2017-3586- CVSS 3.0
- 6.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2017-0382 No score
Updated mysql-connector-java packages fix security vulnerabilities
Thijs Alkemade discovered that unexpected automatic deserialisation of Java objects in the MySQL Connector/J JDBC driver may result in the execution of arbitary code (CVE-2017-3523).
Two vulnerabilities have been found in the MySQL Connector/J JDBC driver (CVE-2017-3586, CVE-2017-3589).
- Record
MGASA-2017-0382- Updated
- 2026-11-02
OSVSUSE-SU-2017:2591-1 No score
Security update for mysql-connector-java
This update for mysql-connector-java to version to 5.1.42 fixes several issues.
These security issues were fixed:
- CVE-2017-3589: An unspecified vulnerability in MySQL Connector/J could have resulted in unauthorized update, insert or delete access to some of MySQL Connectors accessible data (bnc#1035210)
- CVE-2017-3523: An unspecified vulnerability in MySQL Connector/J could have lead to takeover of MySQL Connectors (bnc#1035697)
- CVE-2017-3586: An unspecified vulnerability in MySQL Connectors could have lead to unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data (bnc#1035211)
More infos are available at http://dev.mysql.com/doc/relnotes/connector-j/en/news-5-1.html
- Record
SUSE-SU-2017:2591-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mysql:mysql-connector-javaMaven |
through 5.1.41 | 5.1.42 |
mysql-connector-javaDebian:7 |
before 5.1.42-1~deb7u1, plus listed versions 5.1.16-25.1.25-15.1.26-15.1.27-15.1.28-1 Show 12 moreShow less5.1.29-15.1.30-15.1.31-15.1.32-15.1.37-15.1.38-15.1.39-15.1.39-1~deb7u15.1.39-1~deb8u15.1.40-15.1.41-15.1.41-1~deb8u1 |
5.1.42-1~deb7u1 |
mysql-connector-javaDebian:8 |
before 5.1.42-1~deb8u1, plus listed versions 5.1.32-15.1.37-15.1.38-15.1.39-15.1.39-1~deb7u1 Show 5 moreShow less5.1.39-1~deb8u15.1.40-15.1.41-15.1.41-1~deb8u15.1.42-1~deb7u1 |
5.1.42-1~deb8u1 |
mysql:mysql-connector-javaMaven |
before 5.1.42, plus listed versions 2.0.143.0.103.0.83.1.113.1.12 Show 45 moreShow less3.1.133.1.145.0.25.0.35.0.45.0.55.0.75.0.85.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.235.1.245.1.255.1.265.1.275.1.285.1.295.1.35.1.305.1.315.1.325.1.335.1.345.1.355.1.365.1.375.1.385.1.395.1.45.1.405.1.415.1.5 |
5.1.42 |
mysql-connector-javaMageia:5 |
before 5.1.42-1.mga5 | 5.1.42-1.mga5 |
mysql-connector-javaMageia:6 |
before 5.1.42-1.mga6 | 5.1.42-1.mga6 |
mysql-connector-javaSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 5.1.42-5.4.1 | 5.1.42-5.4.1 |
mysql-connector-javaSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 5.1.42-5.4.1 | 5.1.42-5.4.1 |
mysql-connector-javaUbuntu:14.04:LTS |
All versions, plus listed versions 5.1.25-15.1.26-15.1.27-15.1.28-1 |
None known |
mysql-connector-javaUbuntu:16.04:LTS |
All versions, plus listed versions 5.1.32-15.1.38-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-3586 is a medium vulnerability (CVSS 6.4) in Oracle Mysql Connectors, published April 24, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.71%, the 77th percentile. Fixed in mysql:mysql-connector-java 5.1.42.
References
securitytracker.com/id/1038287
oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
debian.org/security/2017/dsa-3857
securityfocus.com/bid/97982
nvd.nist.gov/vuln/detail/CVE-2017-3586
Show 14 moreShow less
github.com/advisories/GHSA-pwh7-92h3-mqr6
advisories.mageia.org/MGASA-2017-0382.html
bugs.mageia.org/show_bug.cgi?id=20731
computest.nl/advisories/CT-2017-0425_MySQL-Connector-J.txt
suse.com/support/update/announcement/2017/suse-su-20172591-1
bugzilla.suse.com/1035210
ubuntu.com/security/CVE-2017-3586
cve.org/CVERecord?id=CVE-2017-3586
Left out here: 3 versions. The JSON record has them.