PT-2022-27461 · Chocolatey · Chocolatey Ruby Package

Published 2022-11-29 · Updated 2025-04-25 · CVE-2022-45301

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chocolatey Ruby package versions 3.1.2.1 and below

Description The issue is related to insecure permissions in the Chocolatey Ruby package, which grants all users in the Authenticated Users group write privileges for the path C:toolsruby31 and all files located in that folder.

Recommendations For Chocolatey Ruby package versions 3.1.2.1 and below, consider restricting write access to the C:toolsruby31 path and its contents to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-45301

Affected Products

Chocolatey Ruby Package

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-45301 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45301 · Vendor Advisory
• https://github.com/ycdxsb/Vuln/blob/main/ruby-weak-permission-vuln/ruby-weak-permission-vuln.md · Note
• https://t.me/cvenotify/119809 · Telegram Post
• https://t.me/cvenotify/38651 · Telegram Post
• https://t.me/cibsecurity/53632 · Telegram Post