CVE-2025-0733

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-0733", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-01-27T10:53:50.910Z", "datePublished": "2025-01-27T18:00:13.776Z", "dateUpdated": "2025-01-27T19:52:30.190Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-01-27T18:00:13.776Z"}, "title": "Postman profapi.dll untrusted search path", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-426", "lang": "en", "description": "Untrusted Search Path"}]}], "affected": [{"vendor": "n/a", "product": "Postman", "versions": [{"version": "11.0", "status": "affected"}, {"version": "11.1", "status": "affected"}, {"version": "11.2", "status": "affected"}, {"version": "11.3", "status": "affected"}, {"version": "11.4", "status": "affected"}, {"version": "11.5", "status": "affected"}, {"version": "11.6", "status": "affected"}, {"version": "11.7", "status": "affected"}, {"version": "11.8", "status": "affected"}, {"version": "11.9", "status": "affected"}, {"version": "11.10", "status": "affected"}, {"version": "11.11", "status": "affected"}, {"version": "11.12", "status": "affected"}, {"version": "11.13", "status": "affected"}, {"version": "11.14", "status": "affected"}, {"version": "11.15", "status": "affected"}, {"version": "11.16", "status": "affected"}, {"version": "11.17", "status": "affected"}, {"version": "11.18", "status": "affected"}, {"version": "11.19", "status": "affected"}, {"version": "11.20", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in Postman bis 11.20 f\u00fcr Windows gefunden. Hiervon betroffen ist ein unbekannter Codeblock in der Bibliothek profapi.dll. Durch das Beeinflussen mit unbekannten Daten kann eine untrusted search path-Schwachstelle ausgenutzt werden. Der Angriff muss lokal erfolgen. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie ist schwierig auszunutzen."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.5, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.5, "vectorString": "AV:L/AC:H/Au:S/C:P/I:P/A:P"}}], "timeline": [{"time": "2025-01-27T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-01-27T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-01-27T11:59:12.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Havook (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.293511", "name": "VDB-293511 | Postman profapi.dll untrusted search path", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.293511", "name": "VDB-293511 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.481185", "name": "Submit #481185 | Postman Postman API platform v11.20 OS Command Injection", "tags": ["third-party-advisory"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-27T19:52:20.637016Z", "id": "CVE-2025-0733", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-27T19:52:30.190Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0733", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-27T19:52:20.637016Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-27T19:52:25.305Z"}}], "cna": {"title": "Postman profapi.dll untrusted search path", "credits": [{"lang": "en", "type": "reporter", "value": "Havook (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.5, "vectorString": "AV:L/AC:H/Au:S/C:P/I:P/A:P"}}], "affected": [{"vendor": "n/a", "product": "Postman", "versions": [{"status": "affected", "version": "11.0"}, {"status": "affected", "version": "11.1"}, {"status": "affected", "version": "11.2"}, {"status": "affected", "version": "11.3"}, {"status": "affected", "version": "11.4"}, {"status": "affected", "version": "11.5"}, {"status": "affected", "version": "11.6"}, {"status": "affected", "version": "11.7"}, {"status": "affected", "version": "11.8"}, {"status": "affected", "version": "11.9"}, {"status": "affected", "version": "11.10"}, {"status": "affected", "version": "11.11"}, {"status": "affected", "version": "11.12"}, {"status": "affected", "version": "11.13"}, {"status": "affected", "version": "11.14"}, {"status": "affected", "version": "11.15"}, {"status": "affected", "version": "11.16"}, {"status": "affected", "version": "11.17"}, {"status": "affected", "version": "11.18"}, {"status": "affected", "version": "11.19"}, {"status": "affected", "version": "11.20"}]}], "timeline": [{"lang": "en", "time": "2025-01-27T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-01-27T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-01-27T11:59:12.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.293511", "name": "VDB-293511 | Postman profapi.dll untrusted search path", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.293511", "name": "VDB-293511 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.481185", "name": "Submit #481185 | Postman Postman API platform v11.20 OS Command Injection", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in Postman bis 11.20 f\u00fcr Windows gefunden. Hiervon betroffen ist ein unbekannter Codeblock in der Bibliothek profapi.dll. Durch das Beeinflussen mit unbekannten Daten kann eine untrusted search path-Schwachstelle ausgenutzt werden. Der Angriff muss lokal erfolgen. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie ist schwierig auszunutzen."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-426", "description": "Untrusted Search Path"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-01-27T18:00:13.776Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0733", "state": "PUBLISHED", "dateUpdated": "2025-01-27T19:52:30.190Z", "dateReserved": "2025-01-27T10:53:50.910Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-01-27T18:00:13.776Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Postman", "vendor": "n/a", "versions": [{"status": "affected", "version": "11.0"}, {"status": "affected", "version": "11.1"}, {"status": "affected", "version": "11.2"}, {"status": "affected", "version": "11.3"}, {"status": "affected", "version": "11.4"}, {"status": "affected", "version": "11.5"}, {"status": "affected", "version": "11.6"}, {"status": "affected", "version": "11.7"}, {"status": "affected", "version": "11.8"}, {"status": "affected", "version": "11.9"}, {"status": "affected", "version": "11.10"}, {"status": "affected", "version": "11.11"}, {"status": "affected", "version": "11.12"}, {"status": "affected", "version": "11.13"}, {"status": "affected", "version": "11.14"}, {"status": "affected", "version": "11.15"}, {"status": "affected", "version": "11.16"}, {"status": "affected", "version": "11.17"}, {"status": "affected", "version": "11.18"}, {"status": "affected", "version": "11.19"}, {"status": "affected", "version": "11.20"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad clasificada como problem\u00e1tica en Postman hasta la versi\u00f3n 11.20 en Windows. Afecta a una parte desconocida del archivo librer\u00eda profapi.dll. La manipulaci\u00f3n conduce a una ruta de b\u00fasqueda no fiable. El ataque debe abordarse localmente. La complejidad del ataque es bastante alta. Se dice que la explotabilidad es dif\u00edcil. Se contact\u00f3 primeramente con el proveedor sobre esta revelaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2025-0733", "lastModified": "2026-06-17T08:27:03.957", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:H/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 1.5, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0733", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-27T19:52:20.637016Z", "version": "2.0.3"}}]}, "published": "2025-01-27T18:15:40.760", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.293511"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.293511"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.481185"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-426"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2025-07-13T11:07:27.051035+00:00", "updated": "2025-07-13T11:07:27.051089+00:00", "vendors": ["postman", "postman$PRODUCT$postman"]}