CVE-2009-0843

Published: Mar 31, 2009Modified: Apr 23, 2026

7.8

Vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Exploitability: 10.0 / Impact: 6.9

Source: NVD

Description

The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.

Affected (42)

Products: Osgeo: Mapserver · Umn: Mapserver

1 product

1 product

Configuration A

42 vulnerable

Vulnerable Software	Affected Versions
Osgeo Mapserver	Version 4.10.0
Osgeo Mapserver	Version 4.10.0 beta1
Osgeo Mapserver	Version 4.10.0 beta2
Osgeo Mapserver	Version 4.10.0 beta3
Osgeo Mapserver	Version 4.10.0 rc1
Osgeo Mapserver	Version 4.10.1
Osgeo Mapserver	Version 4.10.2
Osgeo Mapserver	Version 4.10.3
Osgeo Mapserver	Version 4.2.0 beta1
Osgeo Mapserver	Version 4.4.0
Osgeo Mapserver	Version 4.4.0 beta1
Osgeo Mapserver	Version 4.4.0 beta2
Osgeo Mapserver	Version 4.4.0 beta3
Osgeo Mapserver	Version 4.6.0
Osgeo Mapserver	Version 4.6.0 beta1
Osgeo Mapserver	Version 4.6.0 beta2
Osgeo Mapserver	Version 4.6.0 beta3
Osgeo Mapserver	Version 4.6.0 rc1
Osgeo Mapserver	Version 4.8.0 beta1
Osgeo Mapserver	Version 4.8.0 beta2
Osgeo Mapserver	Version 4.8.0 beta3
Osgeo Mapserver	Version 4.8.0 rc1
Osgeo Mapserver	Version 4.8.0 rc2
Osgeo Mapserver	Version 5.0.0
Osgeo Mapserver	Version 5.0.0 beta1
Osgeo Mapserver	Version 5.0.0 beta2
Osgeo Mapserver	Version 5.0.0 beta3
Osgeo Mapserver	Version 5.0.0 beta4
Osgeo Mapserver	Version 5.0.0 beta5
Osgeo Mapserver	Version 5.0.0 beta6
Osgeo Mapserver	Version 5.0.0 rc1
Osgeo Mapserver	Version 5.0.0 rc2
Osgeo Mapserver	Version 5.2.0
Osgeo Mapserver	Version 5.2.0 beta1
Osgeo Mapserver	Version 5.2.0 beta2
Osgeo Mapserver	Version 5.2.0 beta3
Osgeo Mapserver	Version 5.2.0 beta4
Osgeo Mapserver	Version 5.2.0 rc1
Osgeo Mapserver	Version 5.2.1
Umn Mapserver	Version 4.0
Umn Mapserver	Version 4.0 beta1
Umn Mapserver	Version 4.0 beta2