CVE-2020-10733: 
PostgreSQL vulnerability analysis and mitigation

CVE-2020-10733 affects the Windows installer for PostgreSQL versions 9.5 through 12. The vulnerability was discovered and disclosed in May 2020, with fixes released in versions 12.3, 11.8, 10.13, 9.6.18, and 9.5.22. The vulnerability impacts the Windows installer's handling of system-provided executables (PostgreSQL News).

The vulnerability stems from the Windows installer invoking system-provided executables without using fully-qualified paths. This allows executables in the installer's loading directory or current working directory to take precedence over intended executables. The vulnerability has a CVSS v3.1 base score of 7.3 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (NetApp Advisory).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). An attacker with permission to add files into the affected directories can execute arbitrary code with the installer's administrative rights (NetApp Advisory).

The vulnerability requires local access and user interaction. An attacker must have permission to add files to either the installer's loading directory or the current working directory to exploit this vulnerability. The attack requires the victim to voluntarily interact with the attack mechanism (NVD).

The vulnerability was fixed in PostgreSQL versions 12.3, 11.8, 10.13, 9.6.18, and 9.5.22. Users running affected versions should upgrade to the patched versions to mitigate this vulnerability (PostgreSQL News).