CVE-2009-0842 | Vulnetix

CVE-2009-0842 PUBLISHED CVSS 4.300000190734863 MEDIUM

mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink.

EPSS 2.65% · 85.3th percentile

Risk Scores

CVSS 2.0

4.300000190734863

EPSS Score

2.65%

85.3th percentile

Affected Products

Vendor	Product	Versions
n/a	n/a	n/a
osgeo	mapserver	4.2.0, 4.4.0, 4.4.0
umn	mapserver	4.0, 4.0, 4.0

Timeline

Mar 31, 2009 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 21, 2022 EPSS Score
Jul 13, 2022 EPSS Score
Oct 28, 2022 EPSS Score
Dec 20, 2022 EPSS Score
Feb 11, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 5, 2023 EPSS Score
May 28, 2023 EPSS Score
Jul 20, 2023 EPSS Score

References

20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3 mailing-list
34306 vdb
[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes mailing-list
http://trac.osgeo.org/mapserver/ticket/2941 url
http://www.positronsecurity.com/advisories/2009-000.html url
1021952 vdb
34603 third-party-advisory
FEDORA-2009-3383 vendor-advisory
34520 third-party-advisory
DSA-1914 vendor-advisory
FEDORA-2009-3357 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2009-0842 advisory

Open in Interactive Console →