7.8

CVE-2009-0843

The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.

Data is provided by the National Vulnerability Database (NVD)
Osgeo ≫ Mapserver Version4.2.0 Updatebeta1
Osgeo ≫ Mapserver Version4.4.0
Osgeo ≫ Mapserver Version4.4.0 Updatebeta1
Osgeo ≫ Mapserver Version4.4.0 Updatebeta2
Osgeo ≫ Mapserver Version4.4.0 Updatebeta3
Osgeo ≫ Mapserver Version4.6.0
Osgeo ≫ Mapserver Version4.6.0 Updatebeta1
Osgeo ≫ Mapserver Version4.6.0 Updatebeta2
Osgeo ≫ Mapserver Version4.6.0 Updatebeta3
Osgeo ≫ Mapserver Version4.6.0 Updaterc1
Osgeo ≫ Mapserver Version4.8.0 Updatebeta1
Osgeo ≫ Mapserver Version4.8.0 Updatebeta2
Osgeo ≫ Mapserver Version4.8.0 Updatebeta3
Osgeo ≫ Mapserver Version4.8.0 Updaterc1
Osgeo ≫ Mapserver Version4.8.0 Updaterc2
Osgeo ≫ Mapserver Version4.10.0
Osgeo ≫ Mapserver Version4.10.0 Updatebeta1
Osgeo ≫ Mapserver Version4.10.0 Updatebeta2
Osgeo ≫ Mapserver Version4.10.0 Updatebeta3
Osgeo ≫ Mapserver Version4.10.0 Updaterc1
Osgeo ≫ Mapserver Version4.10.1
Osgeo ≫ Mapserver Version4.10.2
Osgeo ≫ Mapserver Version4.10.3
Osgeo ≫ Mapserver Version5.0.0
Osgeo ≫ Mapserver Version5.0.0 Updatebeta1
Osgeo ≫ Mapserver Version5.0.0 Updatebeta2
Osgeo ≫ Mapserver Version5.0.0 Updatebeta3
Osgeo ≫ Mapserver Version5.0.0 Updatebeta4
Osgeo ≫ Mapserver Version5.0.0 Updatebeta5
Osgeo ≫ Mapserver Version5.0.0 Updatebeta6
Osgeo ≫ Mapserver Version5.0.0 Updaterc1
Osgeo ≫ Mapserver Version5.0.0 Updaterc2
Osgeo ≫ Mapserver Version5.2.0
Osgeo ≫ Mapserver Version5.2.0 Updatebeta1
Osgeo ≫ Mapserver Version5.2.0 Updatebeta2
Osgeo ≫ Mapserver Version5.2.0 Updatebeta3
Osgeo ≫ Mapserver Version5.2.0 Updatebeta4
Osgeo ≫ Mapserver Version5.2.0 Updaterc1
Osgeo ≫ Mapserver Version5.2.1
Umn ≫ Mapserver Version4.0
Umn ≫ Mapserver Version4.0 Updatebeta1
Umn ≫ Mapserver Version4.0 Updatebeta2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.03% 0.753
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 10 6.9
AV:N/AC:L/Au:N/C:C/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.