# CVE-2017-3319: Oracle MySQL Server information disclosure in X Plugin

Source: https://junglewise.ai/threats/cve-2017-3319-oracle-mysql-server-information-disclosure-in-x-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-27. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-3319 · Severity: low · CVSS 3.1 · Published 2017-01-27

A vulnerability exists in the X Plugin component of Oracle MySQL Server, a widely used database system. A low-privileged attacker with network access could exploit this flaw to gain unauthorized read access to a portion of the data stored on the server. While the vulnerability is difficult to exploit, it could lead to the exposure of sensitive business information.

Technologies: [Oracle Mysql](https://junglewise.ai/threats/technologies/mysql), [Oracle MySQL Server](https://junglewise.ai/threats/technologies/mysql-server). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2017-3319 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-3319 being exploited in the wild.

**How severe is CVE-2017-3319?** Low severity, with a CVSS score of 3.1, published 27 January 2017.

**Which products and versions are affected?** Oracle MySQL Server 5.7.16 and earlier.

**Is there a fix for CVE-2017-3319?** A patch was published on 2017-01-17: Oracle January 2017 Critical Patch Update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-3319 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2017-3319?** Check whether you run Oracle Mysql or Oracle MySQL Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the Server: X Plugin subcomponent of Oracle MySQL Server (versions 5.7.16 and earlier) allows an authenticated, low-privileged attacker with network access via multiple protocols to compromise the server. The vulnerability is characterized by high attack complexity, requiring specific conditions to be met for successful exploitation. If exploited, the attacker can achieve unauthorized read access to a subset of MySQL Server accessible data (CWE-200). Oracle addressed this in the January 2017 Critical Patch Update, and users are advised to upgrade to MySQL 5.7.17 or later.

## Affected products

- Oracle MySQL Server 5.7.16 and earlier

## Timeline

- 2017-01-27: advisory: Initial NVD publication
- 2017-01-17: patched: Oracle January 2017 Critical Patch Update released

## References

- [http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html](http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html)
- [http://www.securityfocus.com/bid/95479](http://www.securityfocus.com/bid/95479)
- [http://www.securitytracker.com/id/1037640](http://www.securitytracker.com/id/1037640)
- [https://access.redhat.com/errata/RHSA-2017:2886](https://access.redhat.com/errata/RHSA-2017:2886)
- [https://security.gentoo.org/glsa/201702-17](https://security.gentoo.org/glsa/201702-17)

## Related threats

- [Oracle MySQL Server XML parsing privilege escalation](https://junglewise.ai/threats/cve-2026-101803-vulnerability-in-the-mysql-server-mysql-cluster-product-of)
- [Oracle MySQL Server parser denial of service](https://junglewise.ai/threats/cve-2026-101802-vulnerability-in-the-mysql-server-mysql-cluster-product-of)
- [Oracle MySQL Server Optimizer denial of service](https://junglewise.ai/threats/cve-2026-101801-vulnerability-in-the-mysql-server-mysql-cluster-product-of)
- [Oracle MySQL Server privilege escalation in Security: Privileges](https://junglewise.ai/threats/cve-2026-101800-vulnerability-in-the-mysql-server-mysql-cluster-product-of)
- [Oracle MySQL Server denial of service in Group Replication](https://junglewise.ai/threats/cve-2026-101799-vulnerability-in-the-mysql-server-mysql-cluster-product-of)