Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL
CVE-2023-5166

8HIGH

Key Information:

Vendor

Docker Inc.

Status
Docker Desktop
Vendor
CVE Published:
25 September 2023

What is CVE-2023-5166?

Docker Desktop versions prior to 4.23.0 are vulnerable to a security flaw that enables attackers to steal access tokens by exploiting a manipulated extension icon URL. This vulnerability can facilitate unauthorized access to sensitive information, making it essential for users to upgrade to the latest version to protect their systems.

Affected Version(s)

Docker Desktop Windows 0 < 4.23.0

References

https://docs.docker.com/desktop/release-notes/#4230
release-notes

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

M. Haunschmid
.
CVE-2023-5166 : Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL