VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 19 hours ago

CVE-2017-10114

8.3 High Out of RASP scope

Description

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u141 and 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 9 years.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 2.3% chance in 30 days

Waratek Defense Posture

Out of RASP scope

A genuine Java vulnerability in a supported product that the agent cannot reach: a coverage gap, not an out-of-domain finding.

  • Protection none
  • Action not-needed none
  • Review automated inferred
  • Record active
Decided by oracle-component : The defect being in a component of a tracked product the agent does not reach: JavaFX, the Java SE installer, the native WebLogic proxy plug-in. Oracle gives these no CPE of their own and names them only in the description.
Finding This CVE affects Oracle's JavaFX component, which Waratek RASP does not instrument. Oracle does not assign JavaFX its own CPE product, so this is detected from the CVE description rather than CPE data.

CVSS

8.3 HIGH v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.3 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H NVD Primary published
CVSS 2.0 5.1 no band published AV:N/AC:H/Au:N/C:P/I:P/A:P NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update July 2017 ↗ CPU 2017-Q3 Oracle Java SE / JavaFX (Java SE: 7u141, 8u131)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Java SE JavaFX Java SE: 7u141, 8u131 7.0.141.0 · 8.0.131.0

🖥️ Product CPEs & Version Ranges

19 product(s) over 26 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd debian debian linux generic 9.0
nvd netapp active iq unified manager generic ≥ 7.3 · ≥ 9.5
nvd netapp cloud backup generic any version
nvd netapp e-series santricity os controller generic ≥ 11.0 and ≤ 11.70.1
nvd netapp e-series santricity storage manager generic any version
nvd netapp element software generic any version
nvd netapp oncommand balance generic any version
nvd netapp oncommand insight generic any version
nvd netapp oncommand performance manager generic any version
nvd netapp oncommand shift generic any version
nvd netapp oncommand unified manager generic any version · ≤ 7.1
nvd netapp plug-in for symantec netbackup generic any version
nvd netapp snapmanager generic any version
nvd netapp steelstore cloud integrated storage generic any version
nvd netapp storage replication adapter for clustered data ontap generic ≥ 7.2 · 9.6
nvd netapp vasa provider for clustered data ontap generic 6.0 · ≥ 7.2
nvd netapp virtual storage console generic 6.0 · ≥ 7.2
nvd oracle jdk javase 1.7.0:update141 · 1.8.0:update131
nvd oracle jre javase 1.7.0:update141 · 1.8.0:update131

Manual classification context

A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** MULTIPLE, SEE NOTE 1, JAVAFX, NO AUTH REMOTE EXPLOIT **Products:** ORACLE JDK, JAVA SE, ORACLE JAVA SE

References

URLTags
https://access.redhat.com/errata/RHSA-2017:1790 ADVISORY, RHSA-2017:1790
https://access.redhat.com/security/cve/CVE-2017-10114 REPORT, RHSA-2017:1790
http://www.debian.org/security/2017/dsa-4005 Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/99726 Broken Link
http://www.securitytracker.com/id/1038931 Broken Link
https://access.redhat.com/errata/RHSA-2017:1791 Third Party Advisory
https://security.gentoo.org/glsa/201709-22 Third Party Advisory
https://security.netapp.com/advisory/ntap-20170720-0001/ Third Party Advisory

Timeline

Published 2017-08-08 Last modified 2026-06-17
Published2017-08-08By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.