Vulnerability · Published Sep 25, 2023 · Assigned by Docker
CVE-2023-0633In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPE
High 7.2
In plain English
A high-severity argument injection in Docker Desktop from Docker Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.4%top 66.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (LPE).This issue affects Docker Desktop: before 4.12.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Docker Inc. | Docker Desktop | 0 – before 4.12.0 |
Weakness: CWE-88 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
References
- https://docs.docker.com/desktop/release-notes/#4120 release-notes