PT-2025-4025 · Postman · Postman

Havook + 1 · Published 2025-01-27 · Updated 2025-01-27 · CVE-2025-0733

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:L/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Postman versions up to 11.20

Description A problematic issue has been found in Postman on Windows, affecting an unknown part of the library file profapi.dll. The manipulation leads to an untrusted search path. The attack must be approached locally and has a rather high complexity, with difficult exploitability. The vendor was contacted about this disclosure but did not respond.

Recommendations For Postman versions up to 11.20, as a temporary workaround, consider restricting access to the library file profapi.dll to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2025-02598

CVE-2025-0733

Affected Products

Postman

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-0733 · Security Note
• https://bdu.fstec.ru/vul/2025-02598 · Security Note
• https://vuldb.com/?submit.481185 · Note
• https://twitter.com/CVEnew/status/1883948996814688389 · Twitter Post
• https://vuldb.com/?id.293511 · Note
• https://t.me/cvedetector/16494 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1883834264552104370 · Twitter Post
• https://vuldb.com/?ctiid.293511 · Note