HOME VULNERABILITIESCVE-2017-10388

HIGH

CVE-2017-10388

NVD-CWE-noinfoPublished: October 19, 2017· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: Applies to the Java SE Kerberos client. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

Technical Analysis

CVE-2017-10388 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.5.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges Req.None

User InteractionRequired

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Vendors & Products

Debian1 product(s)

debian linux

netapp19 product(s)

active iq unified managercloud backupe-series santricity management plug-inse-series santricity os controllere-series santricity storage managere-series santricity web serviceselement softwareoncommand balanceoncommand insightoncommand performance manageroncommand shiftoncommand unified manager+7

Oracle2 product(s)

jdkjre

Red Hat7 product(s)

satelliteenterprise linux desktopenterprise linux eusenterprise linux serverenterprise linux server ausenterprise linux server tusenterprise linux workstation

Source: NVD CPE · 50 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

PATCHhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:2998

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:2999

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3046

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3047

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3264

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3267

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3268

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3392

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3453

ADVISORYhttps://lists.debian.org/debian-lts-announce/2017/11/msg00033.html

ADVISORYhttps://security.gentoo.org/glsa/201710-31

ADVISORYhttps://security.gentoo.org/glsa/201711-14

ADVISORYhttps://security.netapp.com/advisory/ntap-20171019-0001/

ADVISORYhttps://www.debian.org/security/2017/dsa-4015

ADVISORYhttps://www.debian.org/security/2017/dsa-4048

ADVISORYhttps://www.synology.com/support/security/Synology_SA_17_66_OpenJDK

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:2998

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:2999

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3046

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3047

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3264

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3267

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3268

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3392

ADVISORYhttps://access.redhat.com/errata/RHSA-2017:3453

ADVISORYhttps://lists.debian.org/debian-lts-announce/2017/11/msg00033.html

ADVISORYhttps://security.gentoo.org/glsa/201710-31

ADVISORYhttps://security.gentoo.org/glsa/201711-14

ADVISORYhttps://security.netapp.com/advisory/ntap-20171019-0001/

ADVISORYhttps://www.debian.org/security/2017/dsa-4015

ADVISORYhttps://www.debian.org/security/2017/dsa-4048

ADVISORYhttps://www.synology.com/support/security/Synology_SA_17_66_OpenJDK

All References (38)

→

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlPatch · Vendor Advisory

→

http://www.securityfocus.com/bid/101321Broken Link

→

http://www.securitytracker.com/id/1039596Broken Link

→

https://access.redhat.com/errata/RHSA-2017:2998Third Party Advisory

→

https://access.redhat.com/errata/RHSA-2017:2999Third Party Advisory

→

https://access.redhat.com/errata/RHSA-2017:3046Third Party Advisory

→

https://access.redhat.com/errata/RHSA-2017:3047Third Party Advisory

→

https://access.redhat.com/errata/RHSA-2017:3264Third Party Advisory

→

https://access.redhat.com/errata/RHSA-2017:3267Third Party Advisory

→

https://access.redhat.com/errata/RHSA-2017:3268Third Party Advisory

→

https://access.redhat.com/errata/RHSA-2017:3392Third Party Advisory

→

https://access.redhat.com/errata/RHSA-2017:3453Third Party Advisory

→

https://lists.debian.org/debian-lts-announce/2017/11/msg00033.htmlMailing List · Third Party Advisory

→

https://security.gentoo.org/glsa/201710-31Third Party Advisory

→

https://security.gentoo.org/glsa/201711-14Third Party Advisory

Quick Facts

CVE IDCVE-2017-10388

CVSS Score7.5 / 10

SeverityHIGH

WeaknessNVD-CWE-noinfo

CISA KEVNo

Affected4 vendor(s)

PublishedOct 19, 2017

Related CVEs (NVD-CWE-noinfo)

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2017-10388 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWatch. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2017-10388·NVD