CVE-2017-3586: Oracle MySQL Connectors Java - Exposure of Sensitive Information
Summary
CVE-2017-3586: Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java. Affects mysql:mysql-connector-java versions < 5.1.42. Fixed in 5.1.42. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Oracle MySQL Connectors Java is a component of Oracle MySQL that provides a Java interface for connecting to MySQL databases. It allows developers to interact with MySQL databases using Java programming language. The vulnerability, identified as CVE-2017-3586, affects versions 5.1.41 and earlier of the MySQL Connectors Java (Connector/J). This vulnerability can be exploited by a low privileged attacker with network access via multiple protocols.
Vulnerability Detail
The vulnerability in MySQL Connectors Java allows unauthorized access to sensitive information. An attacker with low privileges and network access can compromise the MySQL Connectors component. Although the vulnerability is specific to MySQL Connectors, it can have significant impacts on other products as well. Successful exploitation of this vulnerability can lead to unauthorized update, insert, or delete access to some of the accessible data in MySQL Connectors. Additionally, the attacker can gain unauthorized read access to a subset of the data. The CVSS 3.0 Base Score for this vulnerability is 6.4, indicating moderate impacts on confidentiality and integrity.
How To Fix
Latest published version: 8.0.33 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.1.42
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by updating the MySQL Connector/J to the latest version.
Conclusion
The vulnerability in Oracle MySQL Connectors Java exposes sensitive information to unauthorized actors. It is crucial to update the MySQL Connector/J to the latest version (5.1.42 or later) to mitigate the risk of unauthorized access and maintain the confidentiality and integrity of the data. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mysql:mysql-connector-java →
FAQ
Oracle MySQL Connectors Java is a component of Oracle MySQL that provides a Java interface for connecting to MySQL databases.
Versions 5.1.41 and earlier of MySQL Connectors Java (Connector/J) are affected by this vulnerability.
An attacker can gain unauthorized access to sensitive information, perform unauthorized updates, inserts, or deletes, and read a subset of the accessible data in MySQL Connectors.
The CVSS 3.0 Base Score for this vulnerability is 6.4, indicating moderate impacts on confidentiality and integrity.
To fix this vulnerability, update the MySQL Connector/J to version 5.1.42 or later.
Related vulnerabilities
Recent vulnerabilities recorded for mysql:mysql-connector-java.
