CVE-2020-10733

State: Published
Severity: Not scored
Published: Sep 16, 2020
Updated: Aug 4, 2024
Reserved: Mar 20, 2020

Description

The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer's administrative rights.

Scores

The record has no CVSS score.

Weaknesses

CWE-426

Affected Products

Product	Versions
PostgreSQLn/a	9.5, 9.6, 10, 11, 12Affected

References

https://www.postgresql.org/support/security/11/
https://www.postgresql.org/about/news/2038/
https://security.netapp.com/advisory/ntap-20201001-0006/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.