Actively exploited · Published Aug 28, 2019 · Assigned by mitre
CVE-2019-15752
High 7.8 Exploited
In plain English
A high-severity incorrect permission assignment in Desktop Community Edition from Docker. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 48.8% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
Affected products (as reported)
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://medium.com/%40morgan.henry.roman/elevation-of-privilege-in-docker-for-windows-2fd8450b478e x_refsource_MISC
- http://packetstormsecurity.com/files/157404/Docker-Credential-Wincred.exe-Privilege-Escalation.html x_refsource_MISC
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 mailing-list, x_refsource_MLIST
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15752 government-resource