CVE-2009-0841

2009-03-3118:24:00

CWE-22

[email protected]

web.nvd.nist.gov

security

vulnerability

mapserver

windows

cygwin

remote attack

arbitrary files

6.4 Medium

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.025 Low

EPSS

Percentile

90.1%

JSON

Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to create arbitrary files via a … (dot dot) in the id parameter.

CPENameOperatorVersion
umn:mapserverumn mapservereq4.0
osgeo:mapserverosgeo mapservereq4.2.0
osgeo:mapserverosgeo mapservereq4.4.0
osgeo:mapserverosgeo mapservereq4.6.0
osgeo:mapserverosgeo mapservereq4.8.0
osgeo:mapserverosgeo mapservereq4.10.0
osgeo:mapserverosgeo mapservereq4.10.2
osgeo:mapserverosgeo mapservereq4.10.1
osgeo:mapserverosgeo mapservereq4.10.3
osgeo:mapserverosgeo mapservereq5.0.0

CPE	Name	Operator	Version
umn:mapserver	umn mapserver	eq	4.0
osgeo:mapserver	osgeo mapserver	eq	4.2.0
osgeo:mapserver	osgeo mapserver	eq	4.4.0
osgeo:mapserver	osgeo mapserver	eq	4.6.0
osgeo:mapserver	osgeo mapserver	eq	4.8.0
osgeo:mapserver	osgeo mapserver	eq	4.10.0
osgeo:mapserver	osgeo mapserver	eq	4.10.2
osgeo:mapserver	osgeo mapserver	eq	4.10.1
osgeo:mapserver	osgeo mapserver	eq	4.10.3
osgeo:mapserver	osgeo mapserver	eq	5.0.0