VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 17 hours ago

CVE-2017-10101

9.6 Critical Mitigated by environment configuration

Description

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 9 years.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 2.6% chance in 30 days

Waratek Defense Posture

Mitigated by environment configuration

The vulnerability is mitigated through deployment or application configuration rather than by an ARMR rule. This is a historical determination; the specific configuration change may not be recorded.

  • Protection full the deployment environment, not the agent
  • Action not-needed
  • Review human manual-review
  • Record active
Decided by manual classification : Manual classification of this CVE in the legacy dataset
Finding Manual classification assigned status: MITIGATED-BY-ENVIRONMENT

CVSS

9.6 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.6 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H NVD Primary published
CVSS 2.0 6.8 no band published AV:N/AC:M/Au:N/C:P/I:P/A:P NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update July 2017 ↗ CPU 2017-Q3 Oracle Java SE / JAXP (Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Java SE JAXP Java SE: 6u151, 7u141, 8u131; Java SE Embedded: 8u131 6.0.151.0 · 7.0.141.0 · 8.0.131.0

🖥️ Product CPEs & Version Ranges

26 product(s) over 46 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd debian debian linux generic 8.0 · 9.0
nvd netapp active iq unified manager generic ≥ 7.3 · ≥ 9.5
nvd netapp cloud backup generic any version
nvd netapp e-series santricity os controller generic ≥ 11.0 and ≤ 11.70.1
nvd netapp e-series santricity storage manager generic any version
nvd netapp element software generic any version
nvd netapp oncommand balance generic any version
nvd netapp oncommand insight generic any version
nvd netapp oncommand performance manager generic any version
nvd netapp oncommand shift generic any version
nvd netapp oncommand unified manager generic any version · ≤ 7.1
nvd netapp plug-in for symantec netbackup generic any version
nvd netapp snapmanager generic any version
nvd netapp steelstore cloud integrated storage generic any version
nvd netapp storage replication adapter for clustered data ontap generic ≥ 7.2
nvd netapp vasa provider for clustered data ontap generic 6.0 · ≥ 7.2
nvd netapp virtual storage console generic 6.0 · ≥ 7.2
nvd oracle jdk javase 1.6.0:update151 · 1.7.0:update141 · 1.8.0:update131
nvd oracle jre javase 1.6.0:update151 · 1.7.0:update141 · 1.8.0:update131
nvd redhat enterprise linux desktop generic 6.0 · 7.0
nvd redhat enterprise linux eus generic 7.3 · 7.4 · 7.5 · 7.6 · 7.7
nvd redhat enterprise linux server generic 6.0 · 7.0
nvd redhat enterprise linux server aus generic 7.3 · 7.4 · 7.6
nvd redhat enterprise linux server tus generic 7.3 · 7.4 · 7.6
nvd redhat enterprise linux workstation generic 6.0 · 7.0
nvd redhat satellite generic 5.8

Manual classification context

A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** JAXP, MULTIPLE, SEE NOTE 1, NO AUTH REMOTE EXPLOIT **Products:** JAVA SE EMBEDDED, OPENJDK, JAVA SE, ORACLE JAVA SE

References

URLTags
https://access.redhat.com/errata/RHSA-2017:1789 ADVISORY, RHSA-2017:1789
https://access.redhat.com/security/cve/CVE-2017-10101 REPORT, RHSA-2017:1789
https://access.redhat.com/errata/RHSA-2017:1790 ADVISORY, RHSA-2017:1790
https://access.redhat.com/errata/RHSA-2017:2424 ADVISORY, RHSA-2017:2424
https://access.redhat.com/errata/RHSA-2017:2469 ADVISORY, RHSA-2017:2469
https://access.redhat.com/errata/RHSA-2017:3453 ADVISORY, RHSA-2017:3453
http://www.debian.org/security/2017/dsa-3919 Third Party Advisory
http://www.debian.org/security/2017/dsa-3954 Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/99674 Broken Link

Timeline

Published 2017-08-08 Last modified 2026-06-17
Published2017-08-08By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.