Permissions, Privileges, and Access Controls in Docker - CVE-2016-8867
Published: October 28, 2016 / Updated: August 9, 2020
Vulnerability identifier: #VU40066
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2016-8867
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Docker Inc.
Affected software:
Docker
Docker
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
How to mitigate CVE-2016-8867
Install update from vendor's website.