CVE-2023-40453

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentially trick an administrator into performing an unsafe action (via escape sequence injection), or might have a data size that causes a denial of service to a bastion node. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-116

Affected software

No affected versions have been published.

Timeline

Published
Nov 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-404547.1A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7CVE-2023-4045510.0A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to cCVE-2023-404563.3The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to accessCVE-2023-40457The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause aCVE-2023-404587.5Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attackerCVE-2023-404597.5The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentiCVE-2023-40465.3In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilationCVE-2023-404605.4The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an aCVE-2023-404614.8The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file upload CVE-2023-404627.5The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially CVE-2023-404637.2When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hasCVE-2023-404646.8Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these item