Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

CVE-2009-0842

🗓️ 31 Mar 2009 18:00:00Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 65 Views🌐 WEB

mapserv in MapServer 4.x/5.x allows remote attackers to read arbitrary invalid .map file

Related
Detection
Refs
Paths
Social
ReporterTitlePublishedViews
Family
Cvelist		CVE-2009-0842
31 Mar 200918:00
–cvelist
Debian		[SECURITY] [DSA 1914-1] New mapserver packages fix serveral vulnerabilities
22 Oct 200918:33
–debian
Debian CVE		CVE-2009-0842
31 Mar 200918:00
–debiancve
Tenable Nessus		Debian DSA-1914-1 : mapserver - several vulnerabilities
24 Feb 201000:00
–nessus
Tenable Nessus		Fedora 10 : mapserver-5.2.2-1.fc10 (2009-3357)
23 Apr 200900:00
–nessus
Tenable Nessus		Fedora 9 : mapserver-5.2.2-1.fc9 (2009-3383)
7 Apr 200900:00
–nessus
Tenable Nessus		MapServer < 5.2.2 / 4.10.4 Multiple Flaws
2 Apr 200900:00
–nessus
EUVD		EUVD-2009-0839
7 Oct 202500:30
–euvd
Fedora		[SECURITY] Fedora 10 Update: mapserver-5.2.2-1.fc10
6 Apr 200920:31
–fedora
Fedora		[SECURITY] Fedora 10 Update: mapserver-5.2.3-1.fc10
3 Sep 200900:32
–fedora
Rows per page
NVD
Node
osgeomapserverMatch4.2.0beta1
OR
osgeomapserverMatch4.4.0
OR
osgeomapserverMatch4.4.0beta1
OR
osgeomapserverMatch4.4.0beta2
OR
osgeomapserverMatch4.4.0beta3
OR
osgeomapserverMatch4.6.0
OR
osgeomapserverMatch4.6.0beta1
OR
osgeomapserverMatch4.6.0beta2
OR
osgeomapserverMatch4.6.0beta3
OR
osgeomapserverMatch4.6.0rc1
OR
osgeomapserverMatch4.8.0beta1
OR
osgeomapserverMatch4.8.0beta2
OR
osgeomapserverMatch4.8.0beta3
OR
osgeomapserverMatch4.8.0rc1
OR
osgeomapserverMatch4.8.0rc2
OR
osgeomapserverMatch4.10.0
OR
osgeomapserverMatch4.10.0beta1
OR
osgeomapserverMatch4.10.0beta2
OR
osgeomapserverMatch4.10.0beta3
OR
osgeomapserverMatch4.10.0rc1
OR
osgeomapserverMatch4.10.1
OR
osgeomapserverMatch4.10.2
OR
osgeomapserverMatch4.10.3
OR
osgeomapserverMatch5.0.0
OR
osgeomapserverMatch5.0.0beta1
OR
osgeomapserverMatch5.0.0beta2
OR
osgeomapserverMatch5.0.0beta3
OR
osgeomapserverMatch5.0.0beta4
OR
osgeomapserverMatch5.0.0beta5
OR
osgeomapserverMatch5.0.0beta6
OR
osgeomapserverMatch5.0.0rc1
OR
osgeomapserverMatch5.0.0rc2
OR
osgeomapserverMatch5.2.0
OR
osgeomapserverMatch5.2.0beta1
OR
osgeomapserverMatch5.2.0beta2
OR
osgeomapserverMatch5.2.0beta3
OR
osgeomapserverMatch5.2.0beta4
OR
osgeomapserverMatch5.2.0rc1
OR
osgeomapserverMatch5.2.1
OR
umnmapserverMatch4.0
OR
umnmapserverMatch4.0beta1
OR
umnmapserverMatch4.0beta2
ParameterPositionPathDescriptionCWE
mapquery paramsite/cgi-bin/mapserv?map=/tmp/bof.map&mode=query&queryfile=/tmp/queryfile.qf&savequery=1&id=HHHHIIIIJJJJKKKKMapServer mapserv CGI allows reading arbitrary map files via a full pathname in the map parameter triggering disclosure of file contents.CWE-200
idquery paramsite/cgi-bin/mapserv?map=/tmp/bof.map&mode=query&queryfile=/tmp/queryfile.qf&savequery=1&id=HHHHIIIIJJJJKKKKMapServer mapserv CGI allows reading arbitrary map files via a full pathname in the map parameter triggering disclosure of file contents.CWE-200
modequery paramsite/cgi-bin/mapserv?map=/tmp/bof.map&mode=query&queryfile=/tmp/queryfile.qf&savequery=1&id=HHHHIIIIJJJJKKKKMapServer mapserv CGI allows reading arbitrary map files via a full pathname in the map parameter triggering disclosure of file contents.CWE-200
queryfilequery paramsite/cgi-bin/mapserv?map=/tmp/bof.map&mode=query&queryfile=/tmp/queryfile.qf&savequery=1&id=HHHHIIIIJJJJKKKKMapServer mapserv CGI allows reading arbitrary map files via a full pathname in the map parameter triggering disclosure of file contents.CWE-200
savequeryquery paramsite/cgi-bin/mapserv?map=/tmp/bof.map&mode=query&queryfile=/tmp/queryfile.qf&savequery=1&id=HHHHIIIIJJJJKKKKMapServer mapserv CGI allows reading arbitrary map files via a full pathname in the map parameter triggering disclosure of file contents.CWE-200
mapquery paramsite/cgi-bin/mapserv?map={mapfile}&mode=query&queryfile={queryfile}&savequery=1&id=/../../../tmp/oops&gt;Directory traversal via map parameter could lead to access to sensitive files.CWE-200
modequery paramsite/cgi-bin/mapserv?map={mapfile}&mode=query&queryfile={queryfile}&savequery=1&id=/../../../tmp/oops&gt;Directory traversal via map parameter could lead to access to sensitive files.CWE-200
queryfilequery paramsite/cgi-bin/mapserv?map={mapfile}&mode=query&queryfile={queryfile}&savequery=1&id=/../../../tmp/oops&gt;Directory traversal via map parameter could lead to access to sensitive files.CWE-200
savequeryquery paramsite/cgi-bin/mapserv?map={mapfile}&mode=query&queryfile={queryfile}&savequery=1&id=/../../../tmp/oops&gt;Directory traversal via map parameter could lead to access to sensitive files.CWE-200
idquery paramsite/cgi-bin/mapserv?map={mapfile}&mode=query&queryfile={queryfile}&savequery=1&id=/../../../tmp/oops&gt;Directory traversal via map parameter could lead to access to sensitive files.CWE-200
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
23 Apr 2026 00:35Current
6.2Medium risk
Vulners AI Score6.2
CVSS 24.3
EPSS0.00832
CWE-200
securityvulnerabilitymapservmapservercve-2009-0842remote attackerssymlinknvd
65