Docker Desktop 2.2.0.4 for Windows

CPE Details

Docker Desktop 2.2.0.4 for Windows
docker
desktop
2.2.0.4
2020-03-31
15h06 +00:00
2020-03-31
15h06 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:docker:desktop:2.2.0.4:*:*:*:windows:*:*:*

Informations

Vendor

docker

Product

desktop

Version

2.2.0.4

Software Edition

windows

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2024-8696 2024-09-12 17h54 +00:00 A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.
8.9
Haute
CVE-2024-8695 2024-09-12 17h52 +00:00 A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.
9
Critique
CVE-2024-6222 2024-07-09 17h16 +00:00 In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages. Docker Desktop v4.29.0 https://docs.docker.com/desktop/release-notes/#4290 fixes the issue on MacOS, Linux and Windows with Hyper-V backend. As exploitation requires "Allow only extensions distributed through the Docker Marketplace" to be disabled, Docker Desktop  v4.31.0 https://docs.docker.com/desktop/release-notes/#4310  additionally changes the default configuration to enable this setting by default.
7.3
Haute
CVE-2022-31647 2023-04-27 00h00 +00:00 Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different vulnerability than CVE-2022-26659.
7.1
Haute
CVE-2022-34292 2023-04-27 00h00 +00:00 Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2 API by controlling the DataFolder parameter for DockerDesktop.vhdx, a similar issue to CVE-2022-31647.
7.1
Haute
CVE-2022-37326 2023-04-27 00h00 +00:00 Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling the pidfile field inside the DaemonJSON field in the WindowsContainerStartRequest class. This can indirectly lead to privilege escalation.
7.8
Haute
CVE-2022-38730 2023-04-27 00h00 +00:00 Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-root field inside the DaemonJSON field in the WindowsContainerStartRequest class. This allows exploiting a symlink vulnerability in ..\dataRoot\network\files\local-kv.db because of a TOCTOU race condition.
6.3
Moyen
CVE-2021-37841 2021-08-12 11h30 +00:00 Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it can lead to a full container compromise in both process isolation and Hyper-V isolation modes. This security issue leads an attacker with low privilege to read, write and possibly even execute code inside the containers.
7.8
Haute