Medium severity4.3NVD Advisory· Published Nov 29, 2022· Updated Jun 17, 2026
CVE-2022-45304
CVE-2022-45304
Description
Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\Cmder and all files located in that folder.
Affected products
3cpe:2.3:a:chocolatey:chocolatey_cmder:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:chocolatey:chocolatey_cmder:*:*:*:*:*:*:*:*range: <=1.3.20
- (no CPE)range: <=1.3.20
- Chocolatey/Cmder packagedescription
Patches
Vulnerability mechanics
References
1- github.com/ycdxsb/Vuln/blob/main/cmder-weak-permission-vuln/cmder-weak-permission-vuln.mdnvdBroken LinkThird Party Advisory
News mentions
0No linked articles in our index yet.