#VU40066 Permissions, Privileges, and Access Controls in Docker - CVE-2016-8867
Published: October 28, 2016 / Updated: August 9, 2020
Vulnerability identifier: #VU40066
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2016-8867
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Docker
Docker
Software vendor:
Docker Inc.
Docker Inc.
Description
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
Remediation
Install update from vendor's website.