VYPR
← All advisories
Low severity3.1NVD Advisory· Published Aug 8, 2017· Updated May 13, 2026

CVE-2017-3653

CVE-2017-3653

Description

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A difficult-to-exploit vulnerability in MySQL Server DDL allows low-privileged attackers to modify some data, affecting versions 5.5.56, 5.6.36, 5.7.18 and earlier.

Vulnerability

MySQL Server versions 5.5.56 and earlier, 5.6.36 and earlier, and 5.7.18 and earlier contain a difficult-to-exploit vulnerability in the Server: DDL subcomponent. A low-privileged attacker with network access via multiple protocols can exploit this flaw, potentially resulting in unauthorized update, insert, or delete access to some MySQL Server accessible data [1][2][3][4].

Exploitation

An attacker must have low privileges (e.g., a valid database user account) and network access to the MySQL Server. The attack complexity is high, meaning successful exploitation likely requires additional conditions or precise timing. The attacker uses multiple network protocols to trigger the vulnerable DDL code path, leading to unauthorized data modification [1][2][3][4].

Impact

Successful exploitation results in limited integrity impact: the attacker can update, insert, or delete some data accessible to the MySQL server. No confidentiality or availability impact is described. The privilege level of the attacker remains low, and the scope of the compromise is unchanged (does not propagate to other components) [1][2][3][4].

Mitigation

Oracle has not released patches for the affected versions; the CVE was published in 2017. Red Hat has addressed this vulnerability in MariaDB (a MySQL fork) via RHSA-2017:2787, RHSA-2018:0279, RHSA-2018:0574, and RHSA-2018:2439, updating to versions like 5.5.60-1.el7_5 [1][2][3][4]. Users of Oracle MySQL should upgrade to a patched version if available (e.g., 5.7.19 or later), apply workarounds such as network access restrictions, or migrate to a fork with fixes. Not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

References
  1. https://access.redhat.com/errata/RHSA-2018:2439
  2. https://access.redhat.com/errata/RHSA-2018:0574
  3. https://access.redhat.com/errata/RHSA-2018:0279
  4. https://access.redhat.com/errata/RHSA-2017:2787

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

55

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.