CVE-2023-40354

An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3.

• CWE-312

• https://jira.mariadb.org/browse/MXS-4681Issue Tracking, Vendor Advisory
• https://jira.mariadb.org/browse/MXS-4681Issue Tracking, Vendor Advisory

Published

Aug 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40349Jenkins Gogs Plugin 1.0.15 and earlier improperly initialize…5.3
• CVE-2023-4035The Simple Blog Card WordPress plugin before 1.31 does not v…5.4
• CVE-2023-40350Jenkins Docker Swarm Plugin 1.11 and earlier does not escape…5.4
• CVE-2023-40351A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
• CVE-2023-40352McAfee Safe Connect before 2.16.1.126 may allow an adversary…7.2
• CVE-2023-40353An issue was discovered in Exynos Mobile Processor 980 and 2…3.3
• CVE-2023-40355Cross Site Scripting (XSS) vulnerability in Axigen versions …5.4
• CVE-2023-40356PingOne MFA Integration Kit contains a vulnerability related…8.7
• CVE-2023-40357Multiple TP-LINK products allow a network-adjacent authentic…8
• CVE-2023-40359xterm before 380 supports ReGIS reporting for character-set …9.8
• CVE-2023-4036The Simple Blog Card WordPress plugin before 1.32 does not e…4.3
• CVE-2023-40360QEMU through 8.0.4 accesses a NULL pointer in nvme_directive…5.5