CVE-2017-3310 in Database Server
Summary
by MITRE
Vulnerability in the OJVM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4 and 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise OJVM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in OJVM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of OJVM. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/15/2026
The vulnerability identified as CVE-2017-3310 resides within the Oracle Java Virtual Machine component of Oracle Database Server, specifically affecting versions 11.2.0.4 and 12.1.0.2. This represents a critical security flaw that demonstrates the complex interplay between database components and Java execution environments. The OJVM component serves as Oracle's implementation of the Java Virtual Machine within the database context, enabling the execution of Java-based stored procedures and functions. The vulnerability's presence in this component is particularly concerning given that OJVM operates with elevated privileges and can execute code with database-level access, making it a prime target for attackers seeking to escalate their privileges within database environments.
The technical flaw manifests as an easily exploitable vulnerability that requires minimal privileges for initial access, specifically requiring only Create Session and Create Procedure privileges. This privilege requirement is significant because it represents a relatively common set of permissions that database users might legitimately possess for application development and testing purposes. The vulnerability's exploitability is further enhanced by its network accessibility through multiple protocols, indicating that attackers can potentially leverage this flaw from external network positions without requiring physical access to the database server. The CVSS v3.0 base score of 9.0 reflects the severity of potential impacts across confidentiality, integrity, and availability dimensions, demonstrating that successful exploitation could result in complete compromise of the OJVM execution environment.
The operational impact of this vulnerability extends beyond simple privilege escalation, as successful attacks can result in full takeover of the OJVM component. This compromise represents a significant threat to database security since OJVM serves as a critical execution environment for database applications. The vulnerability's potential to impact additional products underscores the interconnected nature of Oracle database components and highlights how a flaw in one component can cascade into broader system compromise. The requirement for human interaction from a person other than the attacker indicates that while the initial exploitation might be automated, some form of user involvement is necessary, potentially through social engineering or legitimate user activities that trigger the vulnerable code path.
Mitigation strategies for CVE-2017-3310 should focus on immediate patching of affected Oracle Database versions, as this represents the most effective defense against exploitation. Organizations should implement strict privilege controls and ensure that database users only receive the minimum necessary permissions for their legitimate operations. The principle of least privilege becomes critical in preventing unauthorized access to Create Session and Create Procedure privileges that could enable exploitation. Network segmentation and firewall rules should be implemented to limit access to database servers, particularly restricting network protocols that could be leveraged for exploitation. Monitoring and logging of database activities, especially around procedure creation and execution, should be enhanced to detect potential exploitation attempts. From a compliance perspective, this vulnerability aligns with CWE-255 privilege escalation weaknesses and could be categorized under ATT&CK techniques related to privilege escalation and execution through database components. Organizations should also consider implementing database activity monitoring solutions that can detect anomalous behavior patterns consistent with exploitation attempts. The vulnerability demonstrates the importance of maintaining up-to-date security patches and the potential consequences of delayed patch management in database environments.