CVE-2022-45306

Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\agent and all files located in that folder.

Score

CVSS 3.1 4.3 Medium

Status

Modified - cve@mitre.org

Published

2022-11-29

Last modified

2025-04-25

Weaknesses

CWE-732

Affected products

• Chocolatey Azure-pipelines-agent (Chocolatey)

References

• https://github.com/ycdxsb/Vuln/blob/main/azure-pipelines-agent-weak-permission-vuln/azure-pipelines-agent-weak-permissi…