WaratekVRT Sign in

CVE-2017-3307 Oracle MySQL Enterprise Monitor

Affected softwareOracle MySQL Enterprise Monitor
Affected versions3.1.6.8003 and earlier, 3.2.1182 and earlier, 3.3.2.1162 and earlier
Severity3.1 Low CVSS 3.0 2 scores
Fixed inOracle Critical Patch Update April 2017
Published24 Apr 2017
Updated17 Jun 2026

Description

Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Server). Supported versions that are affected are 3.1.6.8003 and earlier, 3.2.1182 and earlier and 3.3.2.1162 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Enterprise Monitor. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Enterprise Monitor accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Enterprise Monitor. CVSS 3.0 Base Score 3.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L).

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 9 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.1% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

3.1 LOW v3.0 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 3.1 LOW CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L NVD Primary published
CVSS 2.0 3.6 none AV:N/AC:H/Au:S/C:N/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2017 ↗ CPU 2017-Q2 Oracle MySQL / Monitoring: Server (3.1.6.8003 and earlier, 3.2.1182 and earlier, 3.3.2.1162 and earlier)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle MySQL Monitoring: Server 3.1.6.8003 and earlier, 3.2.1182 and earlier, 3.3.2.1162 and earlier

Products and versions

1 product, 3 version entries
SourceVendorProductSchemeAffected versions
nvd oracle mysql enterprise monitor generic ≥ 3.1.0 and ≤ 3.1.6.8003 · ≥ 3.2.0 and ≤ 3.2.1182 · ≥ 3.3.0 and ≤ 3.3.2.1162

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** MYSQL PROTOCOL, MONITORING: SERVER **Products:** MYSQL ENTERPRISE MONITOR, ORACLE MYSQL

References

URLTags
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/97844 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038287 Third Party Advisory, VDB Entry

Timeline
Published2017-04-24By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.