CVE-2009-0843 — Improper Input Validation in Mapserver

CWE-20 — Improper Input Validation12 documents6 sources
Severity
7.8HIGHNVD
EPSS
1.0%
top 22.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Osgeo MapserverDebian MapserverUMN Mapserver
Timeline
PublishedMar 31
Latest updateMay 2

Description

The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.

CVSS vector

AV:N/AC:L/C:C/I:N/A:NExploitability: 10.0 | Impact: 6.9

Affected Packages4 packages

▶debiandebian/mapserver< mapserver 5.2.2-1 (bookworm)
▶Debianosgeo/mapserver< 5.2.2-1+3
▶NVDumn/mapserver4.0
▶NVDosgeo/mapserver11 versions+10

Patches

Patch: lists.osgeo.org ↗Patch: lists.osgeo.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-q85f-4wpm-qqjc: The msLoadQuery function in mapserv in MapServer 4↗2022-05-02
▶
OSV
CVE-2009-0843: The msLoadQuery function in mapserv in MapServer 4↗2009-03-31
▶

📋Vendor Advisories

8
Debian
CVE-2009-0843: mapserver - The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x befor...↗2009
▶
Red Hat
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)↗
▶
Red Hat
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)↗
▶
Red Hat
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)↗
▶
Red Hat
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)↗
▶

💬Community

1
Bugzilla
mapserver: multiple security fixes in 5.2.2 and 4.10.4 (CVE-2009-0839, CVE-2009-0840, CVE-2009-0841, CVE-2009-0842, CVE-2009-0843, CVE-2009-1176, CVE-2009-1177)↗2009-04-01
▶
CVE-2009-0843 — Improper Input Validation in Mapserver | cvebase