{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-0733","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2025-01-27T10:53:50.910Z","datePublished":"2025-01-27T18:00:13.776Z","dateUpdated":"2025-01-27T19:52:30.190Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2025-01-27T18:00:13.776Z"},"title":"Postman profapi.dll untrusted search path","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-426","lang":"en","description":"Untrusted Search Path"}]}],"affected":[{"vendor":"n/a","product":"Postman","versions":[{"version":"11.0","status":"affected"},{"version":"11.1","status":"affected"},{"version":"11.2","status":"affected"},{"version":"11.3","status":"affected"},{"version":"11.4","status":"affected"},{"version":"11.5","status":"affected"},{"version":"11.6","status":"affected"},{"version":"11.7","status":"affected"},{"version":"11.8","status":"affected"},{"version":"11.9","status":"affected"},{"version":"11.10","status":"affected"},{"version":"11.11","status":"affected"},{"version":"11.12","status":"affected"},{"version":"11.13","status":"affected"},{"version":"11.14","status":"affected"},{"version":"11.15","status":"affected"},{"version":"11.16","status":"affected"},{"version":"11.17","status":"affected"},{"version":"11.18","status":"affected"},{"version":"11.19","status":"affected"},{"version":"11.20","status":"affected"}]}],"descriptions":[{"lang":"en","value":"A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Es wurde eine problematische Schwachstelle in Postman bis 11.20 für Windows gefunden. Hiervon betroffen ist ein unbekannter Codeblock in der Bibliothek profapi.dll. Durch das Beeinflussen mit unbekannten Daten kann eine untrusted search path-Schwachstelle ausgenutzt werden. Der Angriff muss lokal erfolgen. Die Komplexität eines Angriffs ist eher hoch. Sie ist schwierig auszunutzen."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":2,"vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"LOW"}},{"cvssV3_1":{"version":"3.1","baseScore":4.5,"vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.5,"vectorString":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":3.5,"vectorString":"AV:L/AC:H/Au:S/C:P/I:P/A:P"}}],"timeline":[{"time":"2025-01-27T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-01-27T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-01-27T11:59:12.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Havook (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.293511","name":"VDB-293511 | Postman profapi.dll untrusted search path","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.293511","name":"VDB-293511 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.481185","name":"Submit #481185 | Postman Postman API platform v11.20 OS Command Injection","tags":["third-party-advisory"]}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-27T19:52:20.637016Z","id":"CVE-2025-0733","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-01-27T19:52:30.190Z"}}]}}