Cyber Resilience

CVE-2023-0627

Docker Desktop 4.11.0 – 4.12.0

Published
25 September 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 6.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0024 16th percentile
Risk Priority 49 floored blend · peak EPSS

Summary

CVE-2023-0627 is a medium-severity Trust Boundary Violation (CWE-501) vulnerability in Docker Docker Desktop. Its CVSS base score is 6.7 (Medium).

Operationally, ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affects Docker Desktop: 4.11.X.

CWE(s)

Related Threats

CVEs Like This One

CVE-2023-0629Same product: Docker Docker Desktop
CVE-2023-5165Same product: Docker Docker Desktop
CVE-2023-0628Same product: Docker Docker Desktop
CVE-2023-0633Same product: Docker Docker Desktop
CVE-2025-13743Same product: Docker Docker Desktop
CVE-2023-0626Same product: Docker Docker Desktop
CVE-2023-5166Same product: Docker Docker Desktop
CVE-2023-0625Same product: Docker Docker Desktop
CVE-2026-5843Same product: Docker Docker Desktop
CVE-2023-40453Same vendor: Docker

Affected Assets

docker
docker desktop
4.11.0 — 4.12.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-501

Establishes and maintains trust boundaries with external organizations before allowing their systems to interact with organization resources.

addresses: CWE-501

Prevents information from crossing trust boundaries without explicit approved authorizations.

addresses: CWE-501

Defining interfaces, controls, and trust responsibilities in agreements helps prevent violations of trust boundaries during data exchanges.

addresses: CWE-501

Authorizing and reviewing connections helps maintain proper trust boundaries between internal components.

addresses: CWE-501

Controlling media movement outside controlled areas maintains separation between internal and external trust boundaries.

addresses: CWE-501

Review of inter-system matching programs identifies and corrects trust-boundary violations before data crosses organizational or policy domains.

addresses: CWE-501

Defines explicit trust boundaries for PII use via documented purposes and prevents processing outside those boundaries.

addresses: CWE-501

Explicitly binding attributes to information crossing trust boundaries prevents loss of security context that leads to trust-boundary violations.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices (coding standards, reviews, validation) directly prevent mixing trusted and untrusted data inside the same structures.

ID.AM-03 partial match
prevents

Documented data-flow representations make trust boundaries explicit and help surface mixing of trusted/untrusted data.

PR.IR-01 partial match
prevents

Logical segmentation and access controls enforce separation between trust domains, reducing the chance of co-mingled data structures.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure architecture principles require explicit trust zones and data segregation, mitigating mixing of trusted/untrusted data.

prevents

Secure coding standards can enforce input validation and data tagging, but do not guarantee architectural separation.

prevents

Secure development lifecycle mandates separation of trusted and untrusted data flows, directly preventing mixing in the same structure.

prevents

Application security requirements include explicit trust-boundary definitions and data classification at interfaces.

none

Network segregation reduces external mixing but does not address internal data-structure trust violations.

none

Information access restriction limits who sees data but does not prevent mixing trusted and untrusted data within structures.

References