UpHeron
All vulnerabilities

Servers and applications

CVE-2020-10733

The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer's…

Severity
High 7.3
Published
16 Sept 2020
Last changed
17 Jun 2026
Added to UpHeron
16 Oct 2026
Fixed in
9.5.22, 9.6.18, 10.13, 11.8, 12.3
Sources
NVD

Affected software

SoftwareAffected versions
PostgreSQLServers and applications · cpe:a:postgresql:postgresql
  • From 9.5 before 9.5.22
  • From 9.6 before 9.6.18
  • From 10.0 before 10.13
  • From 11.0 before 11.8
  • From 12.0 before 12.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-10733
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-10733