CVE-2020-10733CWE-426

The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths

published September 16, 2020

CVSS
—
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer's administrative rights.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00530 · 44.0th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2020-09-16T14:55Z
EPSS history
Timeline
  • 16 SEP 14:55Z
    The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths
    cvelistv5