title: In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed
description: In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected.
problem types: CWE-319 Cleartext Transmission of Sensitive Information
affected:
{
defaultStatus: unaffected
modules: Artifactory Integration
platforms: [Windows, MacOS, Linux]
product: Docker Desktop
vendor: Docker
versions:
lessThan: 4.18.0, status: affected, version: 4.17.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:  Update Docker Desktop to version 4.18.0
workarounds: Disable the Access Experimental Features option from the setting panel