Docker Desktop 4.11.x allows --no-windows-containers flag bypass
CVE-2023-0627

6.7MEDIUM

Key Information:

Vendor: Docker Inc.
Status: Docker Desktop
Vendor: CVE Published:; 25 September 2023

🔔 Create Docker Inc. Vulnerability Alert

What is CVE-2023-0627?

Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affects Docker Desktop: 4.11.X.

Affected Version(s)

Docker Desktop Windows 4.11.x

References

https://docs.docker.com/desktop/release-notes/#4120

release-notes

CVSS V3.1

Score:

6.7

Severity:

MEDIUM

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Local

Attack Complexity:

High

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Sep 25, 2023
Vulnerability Reserved
Feb 1, 2023

Credit

Cure53

JSON