CVE-2023-1802 Information disclosure in Docker Desktop
Docker Desktop may leak registry credentials over HTTP if HTTPS health checks fail, requiring network sniffing to exploit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1802?
CVE-2023-1802 is a medium-severity vulnerability in Docker Desktop, published on 6 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected.
Weakness: CWE-319
Which versions are affected by CVE-2023-1802?
It affects 1 product.
Products include Docker Desktop.
How do I fix CVE-2023-1802?
No fix has been published for CVE-2023-1802 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-1802 being exploited?
There is no known exploitation of CVE-2023-1802 in the wild and no public exploit code.
Other vulnerabilities in Docker Desktop
Sources
Also known as GHSA-44rc-4548-4794.