CVE-2017-3241

CRITICAL

Oracle Jdk - Improper Input Validation

Title source: rule

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).

Exploits (3)

exploitdb WORKING POC VERIFIED
by ERPScan · pythondosmultiple
https://www.exploit-db.com/exploits/41145
nomisec WRITEUP 2 stars
by xfei3 · poc
https://github.com/xfei3/CVE-2017-3241-POC
nomisec NO CODE
by scopion · poc
https://github.com/scopion/CVE-2017-3241

References (19)

Scores

CVSS v3 9.0
EPSS 0.7681
EPSS Percentile 99.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (12)
Oracle/Java SE 6u131
Oracle/Java SE 7u121
Oracle/Java SE 8u112
Oracle/Java SE Embedded 8u111
oracle/jdk 1.6 update_131
oracle/jdk 1.7 update_121
oracle/jdk 1.8 update_111 (2 CPE variants)
oracle/jre 1.6 update_131
oracle/jre 1.7 update_121
oracle/jre 1.8 update_111 (2 CPE variants)
... and 2 more
Published Jan 27, 2017
Tracked Since Feb 18, 2026