CVE-2009-0843
6.3 Medium
AI Score
Confidence
Low
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:C/I:N/A:N
0.006 Low
EPSS
Percentile
79.1%
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
References
lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html
secunia.com/advisories/34520
secunia.com/advisories/34603
trac.osgeo.org/mapserver/ticket/2939
www.debian.org/security/2009/dsa-1914
www.positronsecurity.com/advisories/2009-000.html
www.securityfocus.com/archive/1/502271/100/0/threaded
www.securityfocus.com/bid/34306
www.securitytracker.com/id?1021952
www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html
www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html
Social References
More
Related
6.3 Medium
AI Score
Confidence
Low
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:C/I:N/A:N
0.006 Low
EPSS
Percentile
79.1%