CVE-2023-5165 HIGH

CVE-2023-5165: Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell

Vendor Docker Inc.
Product Docker Desktop
Weakness CWE-862 · Missing authorization
Published September 25, 2023
Last update September 24, 2024
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges. This issue has been fixed in Docker Desktop 4.23.0. Affected Docker Desktop versions: from 4.13.0 before 4.23.0.

Key dates

02Disclosure timeline

September 25, 2023 CVE published
September 24, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-25365 WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability CVE-2025-58680 WordPress Gutentor plugin <= 3.5.2 - Broken Access Control vulnerability CVE-2025-62147 WordPress Realbig plugin <= 1.1.3 - Broken Access Control vulnerability CVE-2025-8152 WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons <= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status Update CVE-2025-49907 WordPress MDTF plugin <= 1.3.3.9 - Broken Access Control vulnerability