Lucene search

K
cvelistDockerCVELIST:CVE-2023-1802
HistoryApr 06, 2023 - 8:52 a.m.

CVE-2023-1802 In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed

2023-04-0608:52:19
CWE-319
Docker
www.cve.org
1
cve-2023-1802; docker desktop; artifactory integration; http fallback; sensitive information disclosure; experimental features.

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.7%

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed.Β A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Artifactory Integration"
    ],
    "platforms": [
      "Windows",
      "MacOS",
      "Linux"
    ],
    "product": "Docker Desktop",
    "vendor": "Docker",
    "versions": [
      {
        "lessThan": "4.18.0",
        "status": "affected",
        "version": "4.17.0",
        "versionType": "semver"
      }
    ]
  }
]

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.7%

Related for CVELIST:CVE-2023-1802