VRT 391,810 CVEs tracked · 15,472 in RASP scope · data as of 23 minutes ago

CVE-2017-10293

6.1 Medium Mitigated by environment configuration

Description

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Javadoc). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 8 years.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.5% chance in 30 days

Waratek Defense Posture

Mitigated by environment configuration

The vulnerability is mitigated through deployment or application configuration rather than by an ARMR rule. This is a historical determination; the specific configuration change may not be recorded.

  • Protection full the deployment environment, not the agent
  • Action not-needed
  • Review human manual-review
  • Record active
Decided by manual classification : Manual classification of this CVE in the legacy dataset
Finding Manual classification assigned status: MITIGATED-BY-ENVIRONMENT

CVSS

6.1 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD Primary published
CVSS 2.0 5.8 no band published AV:N/AC:M/Au:N/C:P/I:P/A:N NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update October 2017 ↗ CPU 2017-Q4 Oracle Java SE / Javadoc (Java SE: 6u161, 7u151, 8u144, 9)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Java SE Javadoc Java SE: 6u161, 7u151, 8u144, 9 6.0.161.0 · 7.0.151.0 · 8.0.144.0 · 9.0.0.0

🖥️ Product CPEs & Version Ranges

21 product(s) over 31 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd netapp active iq unified manager generic ≥ 7.3 · ≥ 9.5
nvd netapp cloud backup generic any version
nvd netapp e-series santricity management plug-ins generic any version
nvd netapp e-series santricity os controller generic ≥ 11.0 and ≤ 11.70.1
nvd netapp e-series santricity storage manager generic any version
nvd netapp e-series santricity web services generic any version
nvd netapp element software generic any version
nvd netapp oncommand balance generic any version
nvd netapp oncommand insight generic any version
nvd netapp oncommand performance manager generic any version
nvd netapp oncommand shift generic any version
nvd netapp oncommand unified manager generic any version · ≤ 7.1
nvd netapp oncommand workflow automation generic any version
nvd netapp plug-in for symantec netbackup generic any version
nvd netapp snapmanager generic any version
nvd netapp steelstore cloud integrated storage generic any version
nvd netapp storage replication adapter for clustered data ontap generic ≥ 7.2
nvd netapp vasa provider for clustered data ontap generic 6.0 · ≥ 7.2
nvd netapp virtual storage console generic 6.0 · ≥ 7.2
nvd oracle jdk javase 1.6.0:update161 · 1.7.0:update151 · 1.8.0:update144 · 1.9.0
nvd oracle jre javase 1.6.0:update161 · 1.7.0:update151 · 1.8.0:update144 · 1.9.0

Manual classification context

A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, JAVADOC, SEE NOTE 1, NO AUTH REMOTE EXPLOIT **Products:** ORACLE JDK, JAVA SE, ORACLE JAVA SE

References

URLTags
https://access.redhat.com/errata/RHSA-2017:2999 ADVISORY, RHSA-2017:2999
https://access.redhat.com/security/cve/CVE-2017-10293 REPORT, RHSA-2017:2999
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/101338 Broken Link
http://www.securitytracker.com/id/1039596 Broken Link
https://access.redhat.com/errata/RHSA-2017:3046 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3047 Third Party Advisory
https://security.gentoo.org/glsa/201710-31 Third Party Advisory
https://security.netapp.com/advisory/ntap-20171019-0001/ Third Party Advisory

Timeline

Published 2017-10-19 Last modified 2026-06-17
Published2017-10-19By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.