Lucene search

DockerCVELIST:CVE-2023-0627

HistorySep 25, 2023 - 3:31 p.m.

CVE-2023-0627 Docker Desktop 4.11.x allows --no-windows-containers flag bypass

2023-09-2515:31:58

CWE-501

Docker

www.cve.org

cve-2023-0627

docker desktop

flag bypass

ipc response spoofing

local privilege escalation

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON

Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affects Docker Desktop: 4.11.X.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "x86"
    ],
    "product": "Docker Desktop",
    "vendor": "Docker Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "4.11.x"
      }
    ]
  }
]

References

docs.docker.com/desktop/release-notes/#4120

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVELIST:CVE-2023-0627