CVE-2017-10309

🗓️ 19 Oct 2017 17:00:00Reported by oracleType

cve🔗 web.nvd.nist.gov👁 208 Views🌐 WEB

Vulnerability in Oracle Java SE Deployment component allows unauthorized access and partial denial of service

Reporter	Title	Published	Views	Family All 80
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Directory Server	11 Jan 201916:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium	16 Jun 201822:03	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in IBM Java Runtime affect IBM Host On-Demand	3 Feb 202013:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Manager with OpenStack	8 Aug 201804:13	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Java affect IBM Netezza Analytics for NPS	31 May 202203:16	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Java JRE, 8.0-1.1 affect IBM Netezza Platform Software clients.	7 Dec 202008:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Java affect IBM Netezza Analytics	2 Dec 202004:58	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect z/TPF	15 Jun 201807:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects Rational Functional Tester (CVE-2017-10388, CVE-2017-10356)	29 Sep 201820:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Fabric Manager	24 Jan 201911:40	–	ibm

NVD

Node

oracle jdkMatch1.8.0update144

oracle jdkMatch1.9.0

oracle jreMatch1.8.0update144

oracle jreMatch1.9.0

Node

redhat satelliteMatch5.8

redhat enterprise_linux_desktopMatch6.0

redhat enterprise_linux_desktopMatch7.0

redhat enterprise_linux_eusMatch7.5

redhat enterprise_linux_serverMatch6.0

redhat enterprise_linux_serverMatch7.0

redhat enterprise_linux_workstationMatch6.0

redhat enterprise_linux_workstationMatch7.0

Node

netapp active_iq_unified_managerRange7.3≥windows

netapp active_iq_unified_managerRange9.5≥vmware_vsphere

netapp cloud_backupMatch-

netapp e-series_santricity_management_plug-insMatch-vmware_vcenter

netapp e-series_santricity_os_controllerRange11.0–11.70.1

netapp e-series_santricity_storage_managerMatch-

netapp e-series_santricity_web_servicesMatch-web_services_proxy

netapp element_softwareMatch-

netapp oncommand_balanceMatch-

netapp oncommand_insightMatch-

netapp oncommand_performance_managerMatch-vmware_vsphere

netapp oncommand_shiftMatch-

netapp oncommand_unified_managerRange≤7.1vsphere

netapp oncommand_unified_managerRange≤7.1windows

netapp oncommand_unified_managerMatch-7-mode

netapp oncommand_workflow_automationMatch-

netapp plug-in_for_symantec_netbackupMatch-

netapp snapmanagerMatch-oracle

netapp snapmanagerMatch-sap

netapp steelstore_cloud_integrated_storageMatch-

netapp storage_replication_adapter_for_clustered_data_ontapRange7.2≥vmware_vsphere

netapp storage_replication_adapter_for_clustered_data_ontapRange7.2≥windows

netapp vasa_provider_for_clustered_data_ontapRange7.2≥

netapp vasa_provider_for_clustered_data_ontapMatch6.0

netapp virtual_storage_consoleRange7.2≥vmware_vsphere

netapp virtual_storage_consoleMatch6.0vmware_vsphere

[
  {
    "product": "Java",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Java SE: 8u144"
      },
      {
        "status": "affected",
        "version": "9"
      }
    ]
  }
]

Source	Link
access	www.access.redhat.com/errata/RHSA-2017:2999
exploit-db	www.exploit-db.com/exploits/43103/
access	www.access.redhat.com/errata/RHSA-2017:3264
securityfocus	www.securityfocus.com/bid/101328
security	www.security.gentoo.org/glsa/201710-31
securitytracker	www.securitytracker.com/id/1039596
security	www.security.netapp.com/advisory/ntap-20171019-0001/
access	www.access.redhat.com/errata/RHSA-2017:3267
access	www.access.redhat.com/errata/RHSA-2017:3453
oracle	www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Parameter	Position	Path	Description	CWE
	path	si.xml	XXE payload serving via si.xml used during JNLP processing to exfiltrate data	CWE-200
	path	<random>.jnlp	JNLP file requested by the user agent that triggers XXE processing	CWE-200
data	query param	leaked?data	Exfiltration endpoint receiving stolen data via XXE payload	CWE-200

13 May 2026 00:24Current

7High risk

Vulners AI Score7

CVSS 26.8

CVSS 3.17.1

EPSS0.01939

SSVC