CVE-2017-10268

Oracle Corporation MySQL Server

MEDIUM 4.1

At a glance

Source: NVD
EPSS: EPSS 0.70 % · percentile 53 (2026-10-28)
State: PUBLISHED
Published: 2017-10-19 17:00 UTC
Updated: 2024-10-04 16:56 UTC
Assigner: oracle
NVD status: Modified

Description

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 4.1	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	LOW 1.5	AV:L/AC:M/Au:S/C:P/I:N/A:N	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2017-1915
GCVE · GCVE-0-2017-10268

CERT-FR advisories

CERTFR-2017-AVI-367 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* ≥ 5.5.0 ≤ 5.5.57
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* ≥ 5.6.0 ≤ 5.6.37
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* ≥ 5.7.0 ≤ 5.7.19
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* ≥ 5.5.0 < 5.5.58
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* ≥ 10.0.0 < 10.0.33
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* ≥ 10.1.0 < 10.1.29
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* ≥ 10.2.0 < 10.2.10
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* ≥ 7.3
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* ≥ 9.5
cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vsphere:*:* ≤ 7.1
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:* ≤ 7.1
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

Affected products

Product	Versions
Oracle Corporation · MySQL Server	affected 5.5.57 and earlier ; affected 5.6.37 and earlier ; affected 5.7.19 and earlier

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD