CVE-2017-3600 | Vulnetix

CVE-2017-3600 PUBLISHED CVSS 6.599999904632568 MEDIUM

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. Note: CVE-2017-3600 is equivalent to CVE-2016-5483. CVSS 3.0 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

EPSS 2.64% · 85.0th percentile

Risk Scores

CVSS 3.1

6.599999904632568

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score

2.64%

85.0th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:14.04:LTS	mysql-5.5	5.5.53-0ubuntu0.14.04.1, 5.5.52-0ubuntu0.14.04.1, 5.5.49-0ubuntu0.14.04.1
Ubuntu:14.04:LTS	mariadb-5.5	5.5.44-1ubuntu0.14.04.1, 0, 5.5.32-1ubuntu1
Ubuntu:16.04:LTS	percona-server-5.6	0, 5.6.22-rel71.0-0ubuntu4.1, 5.6.22-rel71.0-0ubuntu4
Ubuntu:16.04:LTS	percona-xtradb-cluster-5.6	5.6.21-25.8-0ubuntu3.2, 5.6.21-25.8-0ubuntu3.1, 5.6.21-25.8-0ubuntu2
Ubuntu:16.04:LTS	mysql-5.7	0, 5.7.11-0ubuntu5, 5.7.11-0ubuntu6

Timeline

Apr 19, 2017 CVE Published
Oct 2, 2020 PoC Published
Nov 6, 2020 PoC Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Aug 25, 2021 EPSS Score
Sep 6, 2021 PoC Published
Dec 28, 2021 EPSS Score
Feb 4, 2022 EPSS Score
Mar 1, 2022 EPSS Score
May 3, 2022 EPSS Score
May 13, 2022 CVE Updated

References

https://ubuntu.com/security/CVE-2017-3600 third-party-advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html third-party-advisory
https://ubuntu.com/security/notices/USN-3269-1 vendor-advisory
https://ubuntu.com/security/notices/USN-3357-2 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2017-3600 third-party-advisory

Open in Interactive Console →