CVE-2023-1802: fallo de gravedad media en Docker Desktop
In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.9epss 0.5%
In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
Docker · Docker DesktopCVEs relacionadas — Docker Desktop
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-9074CRITICALDocker Desktop allows unauthenticated access to Docker Engine API from containersEPSS 1.9%CVE-2024-8695CRITICALA remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.EPSS 1.3%CVE-2024-8696HIGHA remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.EPSS 1.2%CVE-2024-9348HIGHDocker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build viewEPSS 0.5%CVE-2026-17106HIGHTar extraction in moby/go-archive can write outside the destination directory via link followingEPSS 0.4%CVE-2025-3224HIGHElevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory DeletionEPSS 0.2%