// For flags

CVE-2014-5277

Docker Privilege Escalation

Severity Score

5.3
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.

Docker anterior a 1.3.1 y docker-py anterior a 0.5.3 recurre a HTTP cuando la conexión HTTPS del registro falla, lo que permite a atacantes realizar ataques de man-in-the-middle y ataques de downgrade con el fin de obtener datos de autenticación y de imagen, aprovechándose de su posición en la red, es decir, entre el cliente y el registro para bloquear el tráfico HTTPS.

Docker versions prior to 1.3.2 suffer from privilege and container escalation vulnerabilities.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2014-08-16 CVE Reserved
  • 2014-11-17 CVE Published
  • 2024-08-06 CVE Updated
  • 2025-04-05 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-17: DEPRECATED: Code
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Docker
Search vendor "Docker"
 Docker
Search vendor "Docker" for product "Docker"
 <= 1.3.0
Search vendor "Docker" for product "Docker" and version " <= 1.3.0"
-
Affected
Docker
Search vendor "Docker"
 Docker-py
Search vendor "Docker" for product "Docker-py"
 <= 0.5.3
Search vendor "Docker" for product "Docker-py" and version " <= 0.5.3"
-
Affected