10

CVE-2009-0841

Exploit

Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to create arbitrary files via a .. (dot dot) in the id parameter.

Data is provided by the National Vulnerability Database (NVD)
Osgeo ≫ Mapserver Version4.2.0 Updatebeta1
Osgeo ≫ Mapserver Version4.4.0
Osgeo ≫ Mapserver Version4.4.0 Updatebeta1
Osgeo ≫ Mapserver Version4.4.0 Updatebeta2
Osgeo ≫ Mapserver Version4.4.0 Updatebeta3
Osgeo ≫ Mapserver Version4.6.0
Osgeo ≫ Mapserver Version4.6.0 Updatebeta1
Osgeo ≫ Mapserver Version4.6.0 Updatebeta2
Osgeo ≫ Mapserver Version4.6.0 Updatebeta3
Osgeo ≫ Mapserver Version4.6.0 Updaterc1
Osgeo ≫ Mapserver Version4.8.0 Updatebeta1
Osgeo ≫ Mapserver Version4.8.0 Updatebeta2
Osgeo ≫ Mapserver Version4.8.0 Updatebeta3
Osgeo ≫ Mapserver Version4.8.0 Updaterc1
Osgeo ≫ Mapserver Version4.8.0 Updaterc2
Osgeo ≫ Mapserver Version4.10.0
Osgeo ≫ Mapserver Version4.10.0 Updatebeta1
Osgeo ≫ Mapserver Version4.10.0 Updatebeta2
Osgeo ≫ Mapserver Version4.10.0 Updatebeta3
Osgeo ≫ Mapserver Version4.10.0 Updaterc1
Osgeo ≫ Mapserver Version4.10.1
Osgeo ≫ Mapserver Version4.10.2
Osgeo ≫ Mapserver Version4.10.3
Osgeo ≫ Mapserver Version5.0.0
Osgeo ≫ Mapserver Version5.0.0 Updatebeta1
Osgeo ≫ Mapserver Version5.0.0 Updatebeta2
Osgeo ≫ Mapserver Version5.0.0 Updatebeta3
Osgeo ≫ Mapserver Version5.0.0 Updatebeta4
Osgeo ≫ Mapserver Version5.0.0 Updatebeta5
Osgeo ≫ Mapserver Version5.0.0 Updatebeta6
Osgeo ≫ Mapserver Version5.0.0 Updaterc1
Osgeo ≫ Mapserver Version5.0.0 Updaterc2
Osgeo ≫ Mapserver Version5.2.0
Osgeo ≫ Mapserver Version5.2.0 Updatebeta1
Osgeo ≫ Mapserver Version5.2.0 Updatebeta2
Osgeo ≫ Mapserver Version5.2.0 Updatebeta3
Osgeo ≫ Mapserver Version5.2.0 Updatebeta4
Osgeo ≫ Mapserver Version5.2.0 Updaterc1
Osgeo ≫ Mapserver Version5.2.1
Umn ≫ Mapserver Version4.0
Umn ≫ Mapserver Version4.0 Updatebeta1
Umn ≫ Mapserver Version4.0 Updatebeta2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.79% 0.715
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.