CVE-2025-1696

CVSS

No CVSS.

A

vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information via application logs. In affected versions, proxy configuration data—potentially including sensitive details—was written to log files in clear text whenever an HTTP GET request was made through a proxy. An attacker with read access to these logs could obtain the proxy information and leverage it for further attacks or unauthorized access. Starting with version 4.39.0, Docker Desktop no longer logs the proxy string, thereby mitigating this risk.

References

Link	Resource
https://docs.docker.com/desktop/settings-and-maintenance/settings/#proxies
https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs

Configurations

No configuration.

History

06 Mar 2025, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-06 12:15

Updated : 2025-03-06 12:15

NVD link : CVE-2025-1696

Mitre link : CVE-2025-1696

CVE.ORG link : CVE-2025-1696

JSON object : View

Products Affected

No product.

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2025-1696", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.2, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-03-06T12:15:36.293", "references": [{"url": "https://docs.docker.com/desktop/settings-and-maintenance/settings/#proxies", "source": "[email protected]"}, {"url": "https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs", "source": "[email protected]"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information via application logs. In affected versions, proxy configuration data\u2014potentially including sensitive details\u2014was written to log files in clear text whenever an HTTP GET request was made through a proxy. An attacker with read access to these logs could obtain the proxy information and leverage it for further attacks or unauthorized access. Starting with version 4.39.0, Docker Desktop no longer logs the proxy string, thereby mitigating this risk."}, {"lang": "es", "value": "Existe una vulnerabilidad en Docker Desktop anterior a la versi\u00f3n 4.39.0 que podr\u00eda provocar la divulgaci\u00f3n involuntaria de informaci\u00f3n confidencial a trav\u00e9s de los registros de la aplicaci\u00f3n. En las versiones afectadas, los datos de configuraci\u00f3n del proxy (que podr\u00edan incluir detalles confidenciales) se escrib\u00edan en archivos de registro en texto plano cada vez que se realizaba una solicitud HTTP GET a trav\u00e9s de un proxy. Un atacante con acceso de lectura a estos registros podr\u00eda obtener la informaci\u00f3n del proxy y aprovecharla para realizar m\u00e1s ataques o para obtener acceso no autorizado. A partir de la versi\u00f3n 4.39.0, Docker Desktop ya no registra la cadena de proxy, lo que mitiga este riesgo."}], "lastModified": "2025-03-06T12:15:36.293", "sourceIdentifier": "[email protected]"}