CVE-2019-15752 Docker Desktop Community Edition Privilege Escalation
Local attackers can escalate privileges by placing a malicious executable in a shared directory, which is executed with higher privileges during Docker authentication or restart.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-15752?
CVE-2019-15752 is a high-severity vulnerability in n/a, published on 28 Aug 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
Weakness: CWE-732
Which versions are affected by CVE-2019-15752?
It affects 2 products.
Products include Apache Geode, Docker Docker.
How do I fix CVE-2019-15752?
No fix has been published for CVE-2019-15752 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.
Is CVE-2019-15752 being exploited?
Yes. Attackers have exploited CVE-2019-15752 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Metasploit module and 2 Exploit-DB entries.
Other vulnerabilities in n/a
- CVE-2020-1938 Apache Tomcat Improper Privilege Management
- CVE-2022-37021 Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.
- CVE-2014-0048 Supply chain in docker.io
- CVE-2017-15692 Apache Geode unsafe deserialization in TcpServer
- CVE-2025-47410 Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system
Sources
Also known as GHSA-pg68-prcj-h956.