Docker Desktop 4.11.x allows --no-windows-containers flag bypass
CVE-2023-0627

6.7MEDIUM

Key Information:

Vendor

Docker Inc.

Status
Docker Desktop
Vendor
CVE Published:
25 September 2023

What is CVE-2023-0627?

Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affects Docker Desktop: 4.11.X.

Affected Version(s)

Docker Desktop Windows 4.11.x

References

https://docs.docker.com/desktop/release-notes/#4120
release-notes

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cure53
.