7.5high
CVE-2016-8867
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies.
Published 10 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.8%
percentile 86%
Public exploits
0
none known
Summary
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
Exploit prediction (EPSS)
2.75% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
- CWE-264 Permissions, Privileges, and Access Controls
- Technology feeds
- Docker (RSS, critical only)
References
- docker.com /docker-cve-database · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/94228 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1037203 · vdb-entry, x_refsource_SECTRACK, x_transferred
Sources
- CVE List: CVE-2016-8867
- NVD: CVE-2016-8867
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.