CVE-2023-5166

Summary

Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL.

This issue affects Docker Desktop: before 4.23.0.

Affected Software

Weaknesses

• CWE-200: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Workarounds

Disable extensions

ADP Enrichment

CVE Program Container

Additional References

• https://docs.docker.com/desktop/release-notes/#4230

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://docs.docker.com/desktop/release-notes/#4230

• ←Previous
• Next→