# CVE-2017-3313: Oracle MySQL MyISAM unauthorized data access

Source: https://junglewise.ai/threats/cve-2017-3313-oracle-mysql-myisam-unauthorized-data-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-27. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-3313 · Severity: medium · CVSS 4.7 · Published 2017-01-27

A vulnerability in the MyISAM storage engine of Oracle MySQL and MariaDB could allow a local user with low-level access to the server's host system to compromise the database. If successfully exploited, an attacker could gain unauthorized access to sensitive business data or all information stored within the database. While the flaw is difficult to exploit, it poses a risk to data confidentiality for systems where multiple users have local login access.

Technologies: [Oracle MySQL Server](https://junglewise.ai/threats/technologies/mysql-server). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2017-3313 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-3313 being exploited in the wild.

**How severe is CVE-2017-3313?** Medium severity, with a CVSS score of 4.7, published 27 January 2017.

**Which products and versions are affected?** Oracle MySQL Server 5.5.53 and earlier, 5.6.34 and earlier, 5.7.16 and earlier.

**Is there a fix for CVE-2017-3313?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2017-3313 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2017-3313?** Check whether you run Oracle MySQL Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability affects the MyISAM storage engine subcomponent of MySQL Server and MariaDB. It is characterized as a difficult-to-exploit flaw that requires the attacker to have local logon credentials to the infrastructure where the database server is executing. Successful exploitation allows a low-privileged user to bypass certain security restrictions to impact the confidentiality of the data. The vulnerability has been addressed in MySQL versions 5.5.54, 5.6.35, and 5.7.17, as well as MariaDB 10.0.30, 10.1.22, and 10.2.5. NIST classifies this under NVD-CWE-noinfo due to lack of specific root cause details in the vendor advisory.

## Affected products

- Oracle MySQL Server 5.5.53 and earlier, 5.6.34 and earlier, 5.7.16 and earlier
- MariaDB Foundation MariaDB 5.5.0 to 5.5.54, 10.0.0 to 10.0.29, 10.1.0 to 10.1.21, 10.2.0 to 10.2.4

## Timeline

- 2017-01-19: advisory: Debian released DSA 3767-1 for mysql-5.5
- 2017-01-27: disclosed: Initial NVD publication date
- 2017-03-14: advisory: Debian released DSA 3809-1 for mariadb-10.0

## References

- [http://www.debian.org/security/2017/dsa-3767](http://www.debian.org/security/2017/dsa-3767)
- [http://www.debian.org/security/2017/dsa-3809](http://www.debian.org/security/2017/dsa-3809)
- [http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html](http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html)
- [http://www.securityfocus.com/bid/95527](http://www.securityfocus.com/bid/95527)
- [http://www.securitytracker.com/id/1037640](http://www.securitytracker.com/id/1037640)
- [https://access.redhat.com/errata/RHSA-2017:2192](https://access.redhat.com/errata/RHSA-2017:2192)
- [https://access.redhat.com/errata/RHSA-2017:2787](https://access.redhat.com/errata/RHSA-2017:2787)

## Related threats

- [Oracle MySQL Server XML parsing privilege escalation](https://junglewise.ai/threats/cve-2026-101803-vulnerability-in-the-mysql-server-mysql-cluster-product-of)
- [Oracle MySQL Server parser denial of service](https://junglewise.ai/threats/cve-2026-101802-vulnerability-in-the-mysql-server-mysql-cluster-product-of)
- [Oracle MySQL Server Optimizer denial of service](https://junglewise.ai/threats/cve-2026-101801-vulnerability-in-the-mysql-server-mysql-cluster-product-of)
- [Oracle MySQL Server privilege escalation in Security: Privileges](https://junglewise.ai/threats/cve-2026-101800-vulnerability-in-the-mysql-server-mysql-cluster-product-of)
- [Oracle MySQL Server denial of service in Group Replication](https://junglewise.ai/threats/cve-2026-101799-vulnerability-in-the-mysql-server-mysql-cluster-product-of)