Vulnerability Details : CVE-2023-40453
Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentially trick an administrator into performing an unsafe action (via escape sequence injection), or might have a data size that causes a denial of service to a bastion node. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability category: Denial of service
Products affected by CVE-2023-40453
- cpe:2.3:a:docker:machine:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-40453
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 36 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-40453
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2023-40453
-
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
References for CVE-2023-40453
-
https://hackerone.com/reports/1916285
GitLab | Report #1916285 - Arbitrary escape sequence injection in docker-machine from worker nodes | HackerOneExploit;Third Party Advisory
-
https://vin01.github.io/piptagole/docker/security/gitlab/docker-machine/2023/07/07/docker-machine-attack-surface.html
Insecurity of Docker-machine as a virtual machine manager | Vin01’s BlogExploit;Third Party Advisory
-
https://github.com/docker/machine/releases
Releases · docker/machineRelease Notes
Jump to