CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 9.3
CWE Name:  Permissions Privileges and Access Controls
Summary: docker desktop community edition before 2.1.0.1 allows local users to gain privileges by placing a trojan horse docker-credential-wincred.exe file in %programdata%\dockerdesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with docker, restart docker, or run 'docker login' to force the command.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-08-28
Last Modified Date: 2019-09-04