6.8

CVE-2013-7262

SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Osgeo ≫ Mapserver Version <= 6.4.0
Osgeo ≫ Mapserver Version 4.2.0 Update beta1
Osgeo ≫ Mapserver Version 4.4.0
Osgeo ≫ Mapserver Version 4.4.0 Update beta1
Osgeo ≫ Mapserver Version 4.4.0 Update beta2
Osgeo ≫ Mapserver Version 4.4.0 Update beta3
Osgeo ≫ Mapserver Version 4.6.0
Osgeo ≫ Mapserver Version 4.6.0 Update beta1
Osgeo ≫ Mapserver Version 4.6.0 Update beta2
Osgeo ≫ Mapserver Version 4.6.0 Update beta3
Osgeo ≫ Mapserver Version 4.6.0 Update rc1
Osgeo ≫ Mapserver Version 4.8.0 Update beta1
Osgeo ≫ Mapserver Version 4.8.0 Update beta2
Osgeo ≫ Mapserver Version 4.8.0 Update beta3
Osgeo ≫ Mapserver Version 4.8.0 Update rc1
Osgeo ≫ Mapserver Version 4.8.0 Update rc2
Osgeo ≫ Mapserver Version 4.10.0
Osgeo ≫ Mapserver Version 4.10.0 Update beta1
Osgeo ≫ Mapserver Version 4.10.0 Update beta2
Osgeo ≫ Mapserver Version 4.10.0 Update beta3
Osgeo ≫ Mapserver Version 4.10.0 Update rc1
Osgeo ≫ Mapserver Version 4.10.1
Osgeo ≫ Mapserver Version 4.10.2
Osgeo ≫ Mapserver Version 4.10.3
Osgeo ≫ Mapserver Version 4.10.4
Osgeo ≫ Mapserver Version 4.10.5
Osgeo ≫ Mapserver Version 5.0.0
Osgeo ≫ Mapserver Version 5.0.0 Update beta1
Osgeo ≫ Mapserver Version 5.0.0 Update beta2
Osgeo ≫ Mapserver Version 5.0.0 Update beta3
Osgeo ≫ Mapserver Version 5.0.0 Update beta4
Osgeo ≫ Mapserver Version 5.0.0 Update beta5
Osgeo ≫ Mapserver Version 5.0.0 Update beta6
Osgeo ≫ Mapserver Version 5.0.0 Update rc1
Osgeo ≫ Mapserver Version 5.0.0 Update rc2
Osgeo ≫ Mapserver Version 5.2.0
Osgeo ≫ Mapserver Version 5.2.0 Update beta1
Osgeo ≫ Mapserver Version 5.2.0 Update beta2
Osgeo ≫ Mapserver Version 5.2.0 Update beta3
Osgeo ≫ Mapserver Version 5.2.0 Update beta4
Osgeo ≫ Mapserver Version 5.2.0 Update rc1
Osgeo ≫ Mapserver Version 5.2.1
Osgeo ≫ Mapserver Version 5.4.0
Osgeo ≫ Mapserver Version 5.4.0 Update beta1
Osgeo ≫ Mapserver Version 5.4.0 Update beta2
Osgeo ≫ Mapserver Version 5.4.0 Update beta3
Osgeo ≫ Mapserver Version 5.4.0 Update beta4
Osgeo ≫ Mapserver Version 5.4.0 Update rc1
Osgeo ≫ Mapserver Version 5.4.0 Update rc2
Osgeo ≫ Mapserver Version 5.4.1
Osgeo ≫ Mapserver Version 5.4.2
Osgeo ≫ Mapserver Version 5.6.0
Osgeo ≫ Mapserver Version 5.6.1
Osgeo ≫ Mapserver Version 5.6.3
Osgeo ≫ Mapserver Version 6.0.1
Osgeo ≫ Mapserver Version 6.0.2
Osgeo ≫ Mapserver Version 6.0.3
Osgeo ≫ Mapserver Version 6.2.0
Osgeo ≫ Mapserver Version 6.2.1
Umn ≫ Mapserver Version 5.2.3
Umn ≫ Mapserver Version 5.6.7
Umn ≫ Mapserver Version 6.0.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.22% 0.804
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

http://www.mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-1
Vendor Advisory
http://www.securityfocus.com/bid/64671
https://github.com/mapserver/mapserver/commit/3a10f6b829297dae63492a8c63385044bc6953ed
https://github.com/mapserver/mapserver/issues/4834