CVE-2022-45306

2022-11-2900:00:00

mitre

www.cve.org

chocolatey

azure

permissions

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.8%

JSON

Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\agent and all files located in that folder.

References

github.com/ycdxsb/Vuln/blob/main/azure-pipelines-agent-weak-permission-vuln/azure-pipelines-agent-weak-permission-vuln.md