#VU28297 Permissions, Privileges, and Access Controls in Docker Desktop - CVE-2020-10665

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28297

#VU28297 Permissions, Privileges, and Access Controls in Docker Desktop - CVE-2020-10665

Published: May 27, 2020 / Updated: July 15, 2020


Vulnerability identifier: #VU28297
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2020-10665
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: Public exploit is available
Vulnerable software:
Docker Desktop
Software vendor:
Docker Inc.

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes.A local user can execute arbitrary code with NT AUTHORITY\SYSTEM privileges.


Remediation

Install updates from vendor's website.

External links