CVE-2009-0842
Severity Score
4.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink.
mapserv en MapServer 4.x versiones anteriores a v4.10.4 y 5.x versiones anteriores a v5.2.2 permite a atacantes remotos leer ficheros .map inválidos de su elección a través de una ruta completa en el parámetro "map", lo cual dispara la pantalla del contenido de un fichero parcial dentro de un mensaje de error, como lo demostrado por un symlink /tmp/sekrut.map.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2009-03-06 CVE Reserved
- 2009-03-31 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-07 CVE Updated
- 2024-08-07 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/34520 | Third Party Advisory | |
| http://secunia.com/advisories/34603 | Third Party Advisory | |
| http://trac.osgeo.org/mapserver/ticket/2941 | X_refsource_confirm | |
| http://www.securityfocus.com/archive/1/502271/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/34306 | Vdb Entry | |
| http://www.securitytracker.com/id?1021952 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| http://www.positronsecurity.com/advisories/2009-000.html | 2024-08-07 |
| URL | Date | SRC |
|---|---|---|
| http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html | 2021-06-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.2.0 Search vendor "Osgeo" for product "Mapserver" and version "4.2.0" | beta1 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.4.0 Search vendor "Osgeo" for product "Mapserver" and version "4.4.0" | - |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.4.0 Search vendor "Osgeo" for product "Mapserver" and version "4.4.0" | beta1 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.4.0 Search vendor "Osgeo" for product "Mapserver" and version "4.4.0" | beta2 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.4.0 Search vendor "Osgeo" for product "Mapserver" and version "4.4.0" | beta3 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.6.0 Search vendor "Osgeo" for product "Mapserver" and version "4.6.0" | - |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.6.0 Search vendor "Osgeo" for product "Mapserver" and version "4.6.0" | beta1 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.6.0 Search vendor "Osgeo" for product "Mapserver" and version "4.6.0" | beta2 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.6.0 Search vendor "Osgeo" for product "Mapserver" and version "4.6.0" | beta3 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.6.0 Search vendor "Osgeo" for product "Mapserver" and version "4.6.0" | rc1 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.8.0 Search vendor "Osgeo" for product "Mapserver" and version "4.8.0" | beta1 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.8.0 Search vendor "Osgeo" for product "Mapserver" and version "4.8.0" | beta2 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.8.0 Search vendor "Osgeo" for product "Mapserver" and version "4.8.0" | beta3 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.8.0 Search vendor "Osgeo" for product "Mapserver" and version "4.8.0" | rc1 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.8.0 Search vendor "Osgeo" for product "Mapserver" and version "4.8.0" | rc2 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.10.0 Search vendor "Osgeo" for product "Mapserver" and version "4.10.0" | - |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.10.0 Search vendor "Osgeo" for product "Mapserver" and version "4.10.0" | beta1 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.10.0 Search vendor "Osgeo" for product "Mapserver" and version "4.10.0" | beta2 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.10.0 Search vendor "Osgeo" for product "Mapserver" and version "4.10.0" | beta3 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.10.0 Search vendor "Osgeo" for product "Mapserver" and version "4.10.0" | rc1 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.10.1 Search vendor "Osgeo" for product "Mapserver" and version "4.10.1" | - |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.10.2 Search vendor "Osgeo" for product "Mapserver" and version "4.10.2" | - |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 4.10.3 Search vendor "Osgeo" for product "Mapserver" and version "4.10.3" | - |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.0.0 Search vendor "Osgeo" for product "Mapserver" and version "5.0.0" | - |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.0.0 Search vendor "Osgeo" for product "Mapserver" and version "5.0.0" | beta1 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.0.0 Search vendor "Osgeo" for product "Mapserver" and version "5.0.0" | beta2 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.0.0 Search vendor "Osgeo" for product "Mapserver" and version "5.0.0" | beta3 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.0.0 Search vendor "Osgeo" for product "Mapserver" and version "5.0.0" | beta4 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.0.0 Search vendor "Osgeo" for product "Mapserver" and version "5.0.0" | beta5 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.0.0 Search vendor "Osgeo" for product "Mapserver" and version "5.0.0" | beta6 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.0.0 Search vendor "Osgeo" for product "Mapserver" and version "5.0.0" | rc1 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.0.0 Search vendor "Osgeo" for product "Mapserver" and version "5.0.0" | rc2 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.2.0 Search vendor "Osgeo" for product "Mapserver" and version "5.2.0" | - |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.2.0 Search vendor "Osgeo" for product "Mapserver" and version "5.2.0" | beta1 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.2.0 Search vendor "Osgeo" for product "Mapserver" and version "5.2.0" | beta2 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.2.0 Search vendor "Osgeo" for product "Mapserver" and version "5.2.0" | beta3 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.2.0 Search vendor "Osgeo" for product "Mapserver" and version "5.2.0" | beta4 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.2.0 Search vendor "Osgeo" for product "Mapserver" and version "5.2.0" | rc1 |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Mapserver Search vendor "Osgeo" for product "Mapserver" | 5.2.1 Search vendor "Osgeo" for product "Mapserver" and version "5.2.1" | - |
Affected
| ||||||
| Umn Search vendor "Umn" | Mapserver Search vendor "Umn" for product "Mapserver" | 4.0 Search vendor "Umn" for product "Mapserver" and version "4.0" | - |
Affected
| ||||||
| Umn Search vendor "Umn" | Mapserver Search vendor "Umn" for product "Mapserver" | 4.0 Search vendor "Umn" for product "Mapserver" and version "4.0" | beta1 |
Affected
| ||||||
| Umn Search vendor "Umn" | Mapserver Search vendor "Umn" for product "Mapserver" | 4.0 Search vendor "Umn" for product "Mapserver" and version "4.0" | beta2 |
Affected
| ||||||