PT-2022-27463 · Chocolatey · Chocolatey Python3

Published 2022-11-29 · Updated 2025-04-25 · CVE-2022-45305

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chocolatey Python3 package versions 3.11.0 and below

Description The issue is related to insecure permissions in the Chocolatey Python3 package, which grants all users in the Authenticated Users group write privileges for the subfolder C:Python311 and all files located in that folder.

Recommendations For Chocolatey Python3 package versions 3.11.0 and below, consider restricting write access to the C:Python311 subfolder and its files to mitigate the risk of exploitation. As a temporary workaround, review and adjust the permissions of the affected subfolder to ensure that only authorized users have write access.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-45305

Affected Products

Chocolatey Python3

References · 6

• https://osv.dev/vulnerability/CVE-2022-45305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45305 · Security Note
• https://github.com/ycdxsb/Vuln/blob/main/python3-weak-permission-vuln/python3-weak-permission-vuln.md · Note
• https://t.me/cvenotify/38649 · Telegram Post
• https://t.me/cvenotify/119811 · Telegram Post
• https://t.me/cibsecurity/53628 · Telegram Post