CVE-2023-0633 - In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPE

Back Back to CVE browser

HIGH

In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPE

Published Sep 25, 2023

7.8

HIGH

CVSS 3.1

EPSS 0.39%

Description

In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (LPE).This issue affects Docker Desktop: before 4.12.0.

Affected products

Vendor Docker Inc. Product Docker Desktop Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <4.12.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Docker Inc.

Docker Desktop

unaffected

Version	Status	Constraints
0	affected	<4.12.0

Remediation

Vendor solution

Update to 4.12.0

Weaknesses (1)

CWE-88

References (2)

https://docs.docker.com/desktop/release-notes/#4120
release-notesRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12667
Advisory

Link	Providers	Tags
https://docs.docker.com/desktop/release-notes/#4120		release-notesRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12667		Advisory