CVE-2023-5165

HIGH

7.1

Description

Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges. This issue has been fixed in Docker Desktop 4.23.0. Affected Docker Desktop versions: from 4.13.0 before 4.23.0.

CVE Details

CVSS v3.1 Score7.1

SeverityHIGH

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published9/25/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

docker:docker_desktop

Weaknesses (CWE)

CWE-424CWE-862CWE-862

References

https://docs.docker.com/desktop/release-notes/#4230(security@docker.com)

https://docs.docker.com/desktop/release-notes/#4230(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.