CVE-2023-5165: docker inc. docker desktop Improper Protection of Alternate Path
Vulnerability summary
CVE-2023-5165 is a high (CVSS 8.8) Improper Protection of Alternate Path vulnerability in docker inc. docker desktop. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.3% of scored vulnerabilities.
Timeline
- 25-09-2023PublishedVulnerability first disclosed.
- 24-09-2024Last modifiedVulnerability information updated.
Description
Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges. This issue has been fixed in Docker Desktop 4.23.0. Affected Docker Desktop versions: from 4.13.0 before 4.23.0.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NDiffers
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
+0.10 pp
From 0.22% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-424Improper Protection of Alternate PathThe product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Docker1 product
- docker_desktop≥ 4.13.0, < 4.23.0
Docker inc.1 product
- docker desktop≥ 4.13.0, < 4.23.0
2 vendors · 2 products