CVE-2023-5166: Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL
Published Sep 25, 2023
·Updated
Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL.
This issue affects Docker Desktop: before 4.23.0.
Affected Software
1 affected component
Docker Docker Desktop<4.23.0
Remediation
Information
Update Docker Desktop to 4.23.0
Event History
Sep 25, 2023
CVE Published
via MITRE·03:30 PM
Data Sourced
via MITRE·03:30 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-5166.
2
What is the severity of CVE-2023-5166?
The severity of CVE-2023-5166 is high with a CVSS score of 6.5.
3
Which version of Docker Desktop is affected by CVE-2023-5166?
Docker Desktop before version 4.23.0 is affected by CVE-2023-5166.
4
How can Access Token theft occur in Docker Desktop before version 4.23.0?
Access Token theft can occur in Docker Desktop before version 4.23.0 through a crafted extension icon URL.
5
How can I fix the vulnerability CVE-2023-5166?
To fix the vulnerability CVE-2023-5166, users should update Docker Desktop to version 4.23.0 or later.