CVE-2014-6407

Aliases:GHSA-5qgp-p5jc-w2rmGO-2022-0630
Advisory lineage Upstream: 0 Downstream: 7
Modified
Published: 12 Dec 2014, 15:00
Last modified:06 Aug 2024, 12:17

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.5 HIGH
v2.0 (nvd)
EPSS Score
5.86% LOW
6% probability +0.28%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 Dec 2014, 15:00
Published
Vulnerability first disclosed
06 Aug 2024, 12:17
Last Modified
Vulnerability information updated

Description

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.

CVSS Metrics

  • v3.1•HIGH•Score: 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 5.86%• Percentile: 91%

Techniques & Countermeasures

  • CWE-59•Improper Link Resolution Before File Access ('Link Following')

    The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Systems

  • docker•docker

    ≤ 1.3.1 | 1.0.0 | 1.3.0

  • github.com/docker•docker

    < 1.3.2

References (16)