Vulnerability · Published Jul 9, 2024 · Assigned by Docker
CVE-2024-5652In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon config option in Windows containers mode
Medium 6.1
In plain English
A medium-severity uncontrolled resource consumption in Docker Desktop from Docker Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.4%top 68.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon config option in Windows containers mode.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Docker Inc. | Docker Desktop | 0 – before v4.31.0 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
References
- https://docs.docker.com/desktop/release-notes/#4310 release-notes