CVE-2025-0733

Postman profapi.dll untrusted search path

State: Published
Severity: 2.0 Low
Published: Jan 27, 2025
Updated: Jan 27, 2025
Reserved: Jan 27, 2025

Description

A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	2.0 Low	CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	4.5 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	4.5 Medium	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	3.5 Low	AV:L/AC:H/Au:S/C:P/I:P/A:P	VulDB

Weaknesses

CWE-426 Untrusted Search Path

Affected Products

Product	Versions
Postmann/a	11.0Affected 11.1Affected 11.2Affected 11.3Affected 11.4Affected 11.5Affected 11.6Affected 11.7Affected 11.8Affected 11.9Affected 11.10Affected 11.11Affected 11.12Affected 11.13Affected 11.14Affected 11.15Affected 11.16Affected 11.17Affected 11.18Affected 11.19Affected 11.20Affected

References

VDB-293511 | Postman profapi.dll untrusted search pathvdb-entry
VDB-293511 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #481185 | Postman Postman API platform v11.20 OS Command Injectionthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.