Search for vulnerabilities
Vulnerability details: VCID-w2s9-abux-aaae
Vulnerability ID VCID-w2s9-abux-aaae
Aliases CVE-2014-9358
GHSA-qmmc-jppf-32wv
Summary Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-20 Improper Input Validation
CWE-59 Improper Link Resolution Before File Access ('Link Following')
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9358.html
cvssv3.1 6.5 https://access.redhat.com/security/cve/cve-2014-9358
generic_textual MODERATE https://access.redhat.com/security/cve/cve-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00259 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00272 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00357 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00357 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00357 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00357 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00357 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00357 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00357 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.00357 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
epss 0.01286 https://api.first.org/data/v1/epss?cve=CVE-2014-9358
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9358
cvssv3.1 6.5 https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ
generic_textual MODERATE https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ
cvssv3.1 6.5 https://groups.google.com/forum/#!msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ
generic_textual MODERATE https://groups.google.com/forum/#!msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ
cvssv2 6.4 https://nvd.nist.gov/vuln/detail/CVE-2014-9358
cvssv3.1 6.5 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9358
generic_textual MODERATE https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9358
cvssv3.1 6.5 http://www.securityfocus.com/archive/1/534215/100/0/threaded
generic_textual MODERATE http://www.securityfocus.com/archive/1/534215/100/0/threaded
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9358.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-9358.json
https://access.redhat.com/security/cve/cve-2014-9358
https://api.first.org/data/v1/epss?cve=CVE-2014-9358
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9358
https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ
https://groups.google.com/forum/#!msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9358
http://www.securityfocus.com/archive/1/534215/100/0/threaded
772909 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=772909
cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*
CVE-2014-9358 https://nvd.nist.gov/vuln/detail/CVE-2014-9358
RHBA-2014:1977 https://bugzilla.redhat.com/show_bug.cgi?id=1172787
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/security/cve/cve-2014-9358
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://groups.google.com/forum/#!msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2014-9358
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9358
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at http://www.securityfocus.com/archive/1/534215/100/0/threaded
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.46534
EPSS Score 0.00259
Published At April 8, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.