CVSS: 4.3EPSS: 1%CPEs: 42EXPL: 1CVE-2009-0842
https://notcve.org/view.php?id=CVE-2009-0842
mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink. mapserv en MapServer 4.x versiones anteriores a v4.10.4 y 5.x versiones anteriores a v5.2.2 permite a atacantes remotos leer ficheros .map inválidos de su elección a través de una ruta completa en el parámetro "map", lo cual dispara la pantalla del contenido de un fichero parcial dentro de un mensaje de error, como lo demostrado por un symlink /tmp/sekrut.map. • http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html http://secunia.com/advisories/34520 http://secunia.com/advisories/34603 http://trac.osgeo.org/mapserver/ticket/2941 http://www.debian.org/security/2009/dsa-1914 http://www.positronsecurity.com/advisories/2009-000.html http://www.securityfocus.com/archive/1/502271/100/0/threaded http://www.securityfocus.com/bid/34306 http://www.securitytracker.com/id?1021952 https://www.redhat.com/archives/fedora-package-an • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 42EXPL: 0CVE-2009-0843
https://notcve.org/view.php?id=CVE-2009-0843
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists. La función msLoadQuery mapserv en MapServer v4.x y anteriores, v4.10.4 y v5.x anteriores v5.2.2, permite a atacantes remotos determinar la existencia de ficheros a través de un Path completo en el parámetro queryfile, lo que provoca diferentes mensajes de error dependiendo de si existe la ruta. • http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html http://secunia.com/advisories/34520 http://secunia.com/advisories/34603 http://trac.osgeo.org/mapserver/ticket/2939 http://www.debian.org/security/2009/dsa-1914 http://www.positronsecurity.com/advisories/2009-000.html http://www.securityfocus.com/archive/1/502271/100/0/threaded http://www.securityfocus.com/bid/34306 http://www.securitytracker.com/id?1021952 https://www.redhat.com/archives/fedora-package-an • CWE-20: Improper Input Validation •