MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI).
References
| Link | Resource |
|---|---|
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNORAZCJ7AIPJFUY6WGLYIA3QVPWFXFY/ | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVWUC4EOW5WZAZGPLRTZS5QXNUEBPQ5/ | |
| https://mapserver.org/development/changelog/changelog-7-0.html | Release Notes Vendor Advisory |
| https://mapserver.org/development/changelog/changelog-7-2.html | Release Notes Vendor Advisory |
| https://mapserver.org/development/changelog/changelog-7-4.html | Release Notes Vendor Advisory |
| https://mapserver.org/development/changelog/changelog-7-6.html | Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
12 Jul 2022, 17:42
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 |
03 Jun 2022, 17:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNORAZCJ7AIPJFUY6WGLYIA3QVPWFXFY/ - Mailing List, Third Party Advisory | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYVWUC4EOW5WZAZGPLRTZS5QXNUEBPQ5/ - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
03 Jun 2021, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
19 May 2021, 17:29
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 5.3 |
| References | (MISC) https://mapserver.org/development/changelog/changelog-7-4.html - Release Notes, Vendor Advisory | |
| References | (MISC) https://mapserver.org/development/changelog/changelog-7-6.html - Release Notes, Vendor Advisory | |
| References | (MISC) https://mapserver.org/development/changelog/changelog-7-2.html - Release Notes, Vendor Advisory | |
| References | (MISC) https://mapserver.org/development/changelog/changelog-7-0.html - Release Notes, Vendor Advisory | |
| CWE | CWE-863 | |
| CPE | cpe:2.3:a:osgeo:mapserver:*:*:*:*:*:*:*:* |
Information
Published : 2021-05-06 13:15
Updated : 2024-02-04 21:47
NVD link : CVE-2021-32062
Mitre link : CVE-2021-32062
CVE.ORG link : CVE-2021-32062
JSON object : View
Products Affected
osgeo
- mapserver
fedoraproject
- fedora
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')