266 – Excessive Privileges - Docker
Description
The containers executed in the application do not properly restrict the privileges of the users, executing tasks with root user instead of a custom user.
Impact
Gain total control of the container.
Recommendation
- Restrict the privileges of the user that execute instructions inside the container. - Avoid the use of the root user as default user.
Threat
Authenticated attacker with local access to the container.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: L
- Attack complexity: L
- Attack Requirements: N
- Privileges required: L
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): L
- Availability (VA): L
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: U