CVE-2023-1802CWE-319

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed

Medium · published April 6, 2023

CVSS v3.1
5.9
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00549 · 45.2th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2023-04-06T08:52Z
EPSS history
Timeline
  • 06 APR 08:52Z
    In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed
    cvelistv5