CVE-2020-10733: High severity PostgreSQL postgresql vulnerability
The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer's administrative rights.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this PostgreSQL installer vulnerability?
The vulnerability ID for this PostgreSQL installer vulnerability is CVE-2020-10733.
What is the severity level of CVE-2020-10733?
CVE-2020-10733 has a severity level of 7.3 (High).
Which versions of PostgreSQL are affected by CVE-2020-10733?
PostgreSQL versions 9.5 to 12 are affected by CVE-2020-10733.
How does the vulnerability in the PostgreSQL installer occur?
The vulnerability in the PostgreSQL installer occurs when system-provided executables are invoked without fully-qualified paths, allowing an attacker to potentially execute arbitrary code.
Are there any known fixes or patches for CVE-2020-10733?
Yes, patches and updates are available to address the vulnerability. It is recommended to update to the latest version of PostgreSQL to mitigate the risk.