CVE-2023-40354
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
An issue was discovered in MariaDB MaxScale before version 23.02.3, where a user-entered password in the 'maxctrl create service' command is stored in cleartext in the .cnf file.
Risk Assessment
Storing passwords in cleartext poses a risk of unauthorized access to the system, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade to versions 2.5.28, 6.4.9, 22.08.8, or 23.02.3 to mitigate this vulnerability.
Original NVD description (English source)
An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3.