CVE-2023-1802: docker desktop

Vulnerability summary

CVE-2023-1802 is a high (CVSS 7.5) vulnerability in docker desktop. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-04-2023
   PublishedVulnerability first disclosed.
2. 10-02-2025
   Last modifiedVulnerability information updated.

Description

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected.

• CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.