« Volver al listado

CVE-2023-40354

Estado: ModificadaMedia (6.5)—

An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mariadb — Maxscale

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-40354",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-40354",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-09T14:52:26.943567Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-08-14T17:15:10.533",
  "references": [
    {
      "url": "https://jira.mariadb.org/browse/MXS-4681",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://jira.mariadb.org/browse/MXS-4681",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a \"maxctrl create service\" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en MariaDB MaxScale antes del 23.02.3. Un usuario ingresa una contraseña cifrada en una línea de comando \"maxctrl create service\", pero esta contraseña luego se almacena en texto sin cifrar en el archivo .cnf resultante en /var/lib/maxscale/maxscale.cnf.d. Las versiones corregidas son 2.5.28, 6.4.9, 22.08.8 y 23.02.3."
    }
  ],
  "lastModified": "2026-06-17T06:17:23.580",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mariadb:maxscale:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77CA73A9-6917-46F0-A24C-668C3EBFA88B",
              "versionEndExcluding": "2.5.28"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:maxscale:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2363D156-4D49-43A3-AC6D-49EEBDB3A442",
              "versionEndExcluding": "6.4.9",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:maxscale:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00F1E81D-D42C-465D-9EF3-9245BF322B2C",
              "versionEndExcluding": "22.08.8",
              "versionStartIncluding": "22.08"
            },
            {
              "criteria": "cpe:2.3:a:mariadb:maxscale:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "984B258E-397F-495C-B479-B1FC6329BAA1",
              "versionEndExcluding": "23.02.3",
              "versionStartIncluding": "23.02"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}