PT-2022-27465 · Unknown · Chocolatey Php Package

Published 2022-11-29 · Updated 2025-04-25 · CVE-2022-45307

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chocolatey PHP package versions 8.1.12 and below

Description The issue is related to insecure permissions in the Chocolatey PHP package, which grants all users in the Authenticated Users group write privileges for the subfolder C:toolsphp81 and all files located in that folder.

Recommendations For Chocolatey PHP package versions 8.1.12 and below, consider restricting write access to the C:toolsphp81 subfolder and its files to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-45307

Affected Products

Chocolatey Php Package

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-45307 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45307 · Vendor Advisory
• https://github.com/ycdxsb/Vuln/blob/main/php-weak-permission-vuln/php-weak-permission-vuln.md · Note
• https://t.me/cvenotify/119813 · Telegram Post
• https://t.me/cvenotify/38647 · Telegram Post
• https://t.me/cibsecurity/53625 · Telegram Post