CVE-2025-3911

CVSS

No CVSS.

R

ecording of environment variables, configured for running containers, in Docker Desktop application logs could lead to unintentional disclosure of sensitive information such as api keys, passwords, etc. A malicious actor with read access to these logs could obtain sensitive credentials information and further use it to gain unauthorized access to other systems. Starting with version 4.41.0, Docker Desktop no longer logs environment variables set by the user.

References

Link	Resource
https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs

Configurations

No configuration.

History

02 May 2025, 13:53

Type	Values Removed	Values Added
Summary		(es) El registro de variables de entorno configuradas para la ejecución de contenedores en los registros de la aplicación Docker Desktop podría provocar la divulgación involuntaria de información confidencial, como claves API, contraseñas, etc. Un agente malicioso con acceso de lectura a estos registros podría obtener información confidencial de credenciales y utilizarla para obtener acceso no autorizado a otros sistemas. A partir de la versión 4.41.0, Docker Desktop ya no registra las variables de entorno configuradas por el usuario.

29 Apr 2025, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-29 18:15

Updated : 2025-05-02 13:53

NVD link : CVE-2025-3911

Mitre link : CVE-2025-3911

CVE.ORG link : CVE-2025-3911

JSON object : View

Products Affected

No product.

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2025-3911", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.2, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-04-29T18:15:44.370", "references": [{"url": "https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs", "source": "[email protected]"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "Recording of environment variables, configured for running containers, in Docker Desktop application logs could lead to\u00a0unintentional disclosure of sensitive information such as api keys, passwords, etc.\n\nA malicious actor with read access to these logs could obtain sensitive credentials information and further use it to gain unauthorized access to other systems. Starting with version 4.41.0, Docker Desktop no longer logs environment variables set by the user."}, {"lang": "es", "value": "El registro de variables de entorno configuradas para la ejecuci\u00f3n de contenedores en los registros de la aplicaci\u00f3n Docker Desktop podr\u00eda provocar la divulgaci\u00f3n involuntaria de informaci\u00f3n confidencial, como claves API, contrase\u00f1as, etc. Un agente malicioso con acceso de lectura a estos registros podr\u00eda obtener informaci\u00f3n confidencial de credenciales y utilizarla para obtener acceso no autorizado a otros sistemas. A partir de la versi\u00f3n 4.41.0, Docker Desktop ya no registra las variables de entorno configuradas por el usuario."}], "lastModified": "2025-05-02T13:53:40.163", "sourceIdentifier": "[email protected]"}