CVE-2020-15360: com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of client verification

High severity · published Jun 27, 2020

CVE-2020-15360

com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of client verification

7.8

CVSS

0.7%

EPSS

On KEV

Description

com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of client verification.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 52% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Docker Desktop · Docker

2.3.0.3 · source: NVD

Affected product

Docker Desktop

Docker

All Docker Desktop CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-15360

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-15360

Release Notes

https://docs.docker.com/docker-for-windows/release-notes/

Exploit

https://whitehatck01.blogspot.com/2020/06/dockers-latest-version-of-privilege.html