Untrusted search path in PostgreSQL - CVE-2020-10733
Published: May 14, 2020
Vulnerability identifier: #VU27923
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-10733
CWE-ID: CWE-426
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on he system.
The vulnerability exists due to Windows installer runs executables from uncontrolled directories. A local user can trick the victim to install PostgreSQL from a directory that contains a malicious files and execute arbitrary code on the system with elevated privileges.
Note, this vulnerability affects Windows installer only.
Affected software
PostgreSQL
Zoho ManageEngine OpManager
Dell Security Management Server
Zoho ManageEngine OpManager
Dell Security Management Server
How to mitigate CVE-2020-10733
Install updates from vendor's website.
PostgreSQL - addressed in versions 9.5.22, 9.6.18, 10.13, 11.8, 12.3
Zoho ManageEngine OpManager - addressed in versions 12.5 125127, 12.5 125397
Dell Security Management Server - update to 11.0.1
Zoho ManageEngine OpManager - addressed in versions 12.5 125127, 12.5 125397
Dell Security Management Server - update to 11.0.1