# CVE-2017-3231: Oracle Java SE information disclosure in Networking URLClassLoader

Source: https://junglewise.ai/threats/cve-2017-3231-oracle-java-se-information-disclosure-in-networking-urlclassloader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-27. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-3231 · Severity: medium · CVSS 4.3 · Published 2017-01-27

A vulnerability exists in the Networking subcomponent of Oracle Java SE and Java SE Embedded. This issue primarily affects client-side Java applications, such as those running in a web browser or via Java Web Start, that execute untrusted code from the internet. If exploited, an attacker could gain unauthorized access to a limited portion of the data accessible to the Java application, potentially compromising sensitive information. Exploitation requires a user to perform a specific action, such as visiting a malicious website.

Technologies: [Oracle Java SE](https://junglewise.ai/threats/technologies/java-se), [Oracle Java SE Embedded](https://junglewise.ai/threats/technologies/java-se-embedded). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2017-3231 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-3231 being exploited in the wild.

**How severe is CVE-2017-3231?** Medium severity, with a CVSS score of 4.3, published 27 January 2017.

**Which products and versions are affected?** Oracle Java SE 6u131, 7u121, 8u112; Oracle Java SE Embedded 8u111.

**Is there a fix for CVE-2017-3231?** A patch was published on 2017-01-19: Red Hat released security updates for affected Java packages Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-3231 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2017-3231?** Check whether you run Oracle Java SE or Oracle Java SE Embedded at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is classified as an information disclosure (CWE-200) within the Networking subcomponent of Oracle Java SE, specifically related to insufficient access control checks in the URLClassLoader. It is exploitable by an unauthenticated attacker over a network via multiple protocols. The attack requires human interaction (User Interaction: Required), typically involving a user running a sandboxed Java Web Start application or applet that loads untrusted code. A successful exploit allows the attacker to obtain unauthorized read access to a subset of data accessible to the Java environment. This vulnerability was addressed in the Oracle Critical Patch Update for January 2017.

## Affected products

- Oracle Java SE 6u131, 7u121, 8u112
- Oracle Java SE Embedded 8u111

## Timeline

- 2017-01-17: advisory: Oracle Critical Patch Update released
- 2017-01-19: patched: Red Hat released security updates for affected Java packages
- 2017-01-27: disclosed: NVD publication date

## References

- [http://rhn.redhat.com/errata/RHSA-2017-0175.html](http://rhn.redhat.com/errata/RHSA-2017-0175.html)
- [http://rhn.redhat.com/errata/RHSA-2017-0176.html](http://rhn.redhat.com/errata/RHSA-2017-0176.html)
- [http://rhn.redhat.com/errata/RHSA-2017-0177.html](http://rhn.redhat.com/errata/RHSA-2017-0177.html)
- [http://rhn.redhat.com/errata/RHSA-2017-0180.html](http://rhn.redhat.com/errata/RHSA-2017-0180.html)
- [http://rhn.redhat.com/errata/RHSA-2017-0263.html](http://rhn.redhat.com/errata/RHSA-2017-0263.html)
- [http://rhn.redhat.com/errata/RHSA-2017-0269.html](http://rhn.redhat.com/errata/RHSA-2017-0269.html)
- [http://rhn.redhat.com/errata/RHSA-2017-0336.html](http://rhn.redhat.com/errata/RHSA-2017-0336.html)

## Related threats

- [Oracle Java SE JSSE protocol handling vulnerability](https://junglewise.ai/threats/cve-2026-114820-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk)
- [Oracle Java SE JSSE remote data exposure and modification](https://junglewise.ai/threats/cve-2026-91403-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle)
- [Oracle Java SE compiler vulnerability in data access](https://junglewise.ai/threats/cve-2026-91487-vulnerability-in-oracle-java-se-component-compiler-supported)
- [Oracle Java SE Java plugin sandbox escape](https://junglewise.ai/threats/cve-2026-91484-vulnerability-in-oracle-java-se-component-java-plugin-supported)
- [Oracle Java SE JGSS information disclosure](https://junglewise.ai/threats/cve-2026-91464-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle)