Vulnerability-Lookup

FKIE_CVE-2009-0843

Vulnerability from fkie_nvd - Published: 2009-03-31 18:24 - Updated: 2026-06-16 23:05

Severity

Summary

The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.

References

URL	Tags
cve@mitre.org	http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html	Patch
cve@mitre.org	http://secunia.com/advisories/34520
cve@mitre.org	http://secunia.com/advisories/34603
cve@mitre.org	http://trac.osgeo.org/mapserver/ticket/2939
cve@mitre.org	http://www.debian.org/security/2009/dsa-1914
cve@mitre.org	http://www.positronsecurity.com/advisories/2009-000.html
cve@mitre.org	http://www.securityfocus.com/archive/1/502271/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/bid/34306
cve@mitre.org	http://www.securitytracker.com/id?1021952
cve@mitre.org	https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html
cve@mitre.org	https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html	Patch
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/34520
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/34603
af854a3a-2127-422b-91ae-364da2661108	http://trac.osgeo.org/mapserver/ticket/2939
af854a3a-2127-422b-91ae-364da2661108	http://www.debian.org/security/2009/dsa-1914
af854a3a-2127-422b-91ae-364da2661108	http://www.positronsecurity.com/advisories/2009-000.html
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/502271/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/34306
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id?1021952
af854a3a-2127-422b-91ae-364da2661108	https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html
af854a3a-2127-422b-91ae-364da2661108	https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html

Impacted products

Vendor	Product	Version
osgeo	mapserver	4.2.0
osgeo	mapserver	4.4.0
osgeo	mapserver	4.4.0
osgeo	mapserver	4.4.0
osgeo	mapserver	4.4.0
osgeo	mapserver	4.6.0
osgeo	mapserver	4.6.0
osgeo	mapserver	4.6.0
osgeo	mapserver	4.6.0
osgeo	mapserver	4.6.0
osgeo	mapserver	4.8.0
osgeo	mapserver	4.8.0
osgeo	mapserver	4.8.0
osgeo	mapserver	4.8.0
osgeo	mapserver	4.8.0
osgeo	mapserver	4.10.0
osgeo	mapserver	4.10.0
osgeo	mapserver	4.10.0
osgeo	mapserver	4.10.0
osgeo	mapserver	4.10.0
osgeo	mapserver	4.10.1
osgeo	mapserver	4.10.2
osgeo	mapserver	4.10.3
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.0.0
osgeo	mapserver	5.2.0
osgeo	mapserver	5.2.0
osgeo	mapserver	5.2.0
osgeo	mapserver	5.2.0
osgeo	mapserver	5.2.0
osgeo	mapserver	5.2.0
osgeo	mapserver	5.2.1
umn	mapserver	4.0
umn	mapserver	4.0
umn	mapserver	4.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.2.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "7362D32E-07AF-4DFB-A7EE-B92A2949FCC6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "16812C55-8E9F-4035-92E6-D2C7AF4F5B9E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.4.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "5C11F257-809F-4F7C-B5B1-5D407B983DEA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.4.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "3AFFE501-B4E0-4352-8C8D-44531E8A6ED3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.4.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "426DC6E0-2DA2-4815-B08B-EE2CF20AE3AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBEE70D8-0EC2-4855-81C8-9FECCD9C16BF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.6.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "FE55464C-FD27-47BF-9941-26EE7968BF70",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.6.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "E01A6111-3A73-4033-8333-4929A6A22CA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.6.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "CE4F9152-4BA9-4742-9041-9707BB4B505F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.6.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "7F27BB1D-165E-4414-AB9B-5BBDF4268F73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.8.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "9305883D-8626-448C-8B1A-074158F518DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.8.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "04D30449-7EEB-42C4-9F11-4E6EE39C18F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.8.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "DE53FF73-329B-4384-B636-2F4050778FED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.8.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B52B92DB-535F-45B7-AF32-B97216A4C4B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.8.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "C410FF2E-E1C6-4238-94ED-3EC6389C961D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "279DE3C1-7BEB-43A4-A91B-06D3A53C30A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "279EDC4E-87CC-48ED-B735-84F96DC5796E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "53AB964F-61BD-4EC5-8469-7DB371154455",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "C27C5F5A-6B68-4723-809B-C482238F9647",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "43CFB610-77A2-436E-ADD0-C0D647AF56DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED26BFDF-0C8C-4BEF-BB2D-FA7ADB95AFB3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC2E86BD-2358-46D5-BBB5-147168001578",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:4.10.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6257B30-61DC-4838-92E6-D9938224BFA6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C661B582-E2F6-4E91-A47C-E91CCB0ECF2A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "7E60110D-1CED-47BE-8565-FE858BEFF44B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "8B061F26-EF3F-48CC-A974-5B49A622C5FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "0870B801-E121-47D8-9C88-B01C7AB6ED3F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "B0F320C0-1A33-4768-9BB1-09C6554A9C8C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "81C28558-F40D-48B9-B98C-F30709C89AD8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:beta6:*:*:*:*:*:*",
              "matchCriteriaId": "DCEF61F4-F4CE-4E33-A67C-17B1D0185BC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "65E266D2-C1F2-4400-9E41-AEB2F116C733",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.0.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "9161B916-5EED-46C4-8E0C-515A0B6D2902",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9689CB4-A70C-42D7-91E0-68057D9D4779",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "6767A7E5-7A2C-452D-A6EB-9C61B43DC39B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "119B427D-87AC-4DD8-AD13-B8CFC847A947",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "57221C0B-EE09-4EB6-AE21-3C31393EB922",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "74EEC8BC-A00F-4DCF-B787-5B95699DBD80",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "D9030BE8-663A-4F46-B255-0AEBFD790DFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:osgeo:mapserver:5.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1DED21A-FA34-4F6A-8ED5-A985671E5653",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:umn:mapserver:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "203F6A08-17BF-4F82-82C5-E0653C2100F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:umn:mapserver:4.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "E939104D-9765-4DBF-AA1D-97EBBE515972",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:umn:mapserver:4.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "93188DA2-4137-4291-9FDC-469D933C9602",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n msLoadQuery  mapserv en MapServer v4.x y anteriores, v4.10.4 y v5.x anteriores v5.2.2, permite a atacantes remotos determinar la existencia de ficheros a trav\u00e9s de un Path completo en el par\u00e1metro queryfile, lo que provoca diferentes mensajes de error dependiendo de si existe la ruta."
    }
  ],
  "id": "CVE-2009-0843",
  "lastModified": "2026-06-16T23:05:55.977",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 7.8,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-03-31T18:24:45.920",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/34520"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/34603"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://trac.osgeo.org/mapserver/ticket/2939"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2009/dsa-1914"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.positronsecurity.com/advisories/2009-000.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/502271/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/34306"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1021952"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/34520"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/34603"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://trac.osgeo.org/mapserver/ticket/2939"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2009/dsa-1914"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.positronsecurity.com/advisories/2009-000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/502271/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/34306"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1021952"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2009-0843 (GCVE-0-2009-0843)

Vulnerability from cvelistv5 – Published: 2009-03-31 18:00 – Updated: 2024-08-07 04:48

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

11 references

URL	Tags
http://www.positronsecurity.com/advisories/2009-0…	x_refsource_MISC
http://trac.osgeo.org/mapserver/ticket/2939	x_refsource_CONFIRM
http://www.securitytracker.com/id?1021952	vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/archive/1/502271/100…	mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/34603	third-party-advisoryx_refsource_SECUNIA
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA
http://www.securityfocus.com/bid/34306	vdb-entryx_refsource_BID
http://secunia.com/advisories/34520	third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2009/dsa-1914	vendor-advisoryx_refsource_DEBIAN
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA
http://lists.osgeo.org/pipermail/mapserver-users/…	mailing-listx_refsource_MLIST

Date Public

2009-03-30 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:48:52.455Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.positronsecurity.com/advisories/2009-000.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://trac.osgeo.org/mapserver/ticket/2939"
          },
          {
            "name": "1021952",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1021952"
          },
          {
            "name": "20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/502271/100/0/threaded"
          },
          {
            "name": "34603",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34603"
          },
          {
            "name": "FEDORA-2009-3383",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html"
          },
          {
            "name": "34306",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34306"
          },
          {
            "name": "34520",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34520"
          },
          {
            "name": "DSA-1914",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1914"
          },
          {
            "name": "FEDORA-2009-3357",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html"
          },
          {
            "name": "[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-03-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.positronsecurity.com/advisories/2009-000.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://trac.osgeo.org/mapserver/ticket/2939"
        },
        {
          "name": "1021952",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1021952"
        },
        {
          "name": "20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/502271/100/0/threaded"
        },
        {
          "name": "34603",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34603"
        },
        {
          "name": "FEDORA-2009-3383",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html"
        },
        {
          "name": "34306",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34306"
        },
        {
          "name": "34520",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34520"
        },
        {
          "name": "DSA-1914",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1914"
        },
        {
          "name": "FEDORA-2009-3357",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html"
        },
        {
          "name": "[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-0843",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.positronsecurity.com/advisories/2009-000.html",
              "refsource": "MISC",
              "url": "http://www.positronsecurity.com/advisories/2009-000.html"
            },
            {
              "name": "http://trac.osgeo.org/mapserver/ticket/2939",
              "refsource": "CONFIRM",
              "url": "http://trac.osgeo.org/mapserver/ticket/2939"
            },
            {
              "name": "1021952",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1021952"
            },
            {
              "name": "20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/502271/100/0/threaded"
            },
            {
              "name": "34603",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34603"
            },
            {
              "name": "FEDORA-2009-3383",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html"
            },
            {
              "name": "34306",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34306"
            },
            {
              "name": "34520",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34520"
            },
            {
              "name": "DSA-1914",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2009/dsa-1914"
            },
            {
              "name": "FEDORA-2009-3357",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html"
            },
            {
              "name": "[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes",
              "refsource": "MLIST",
              "url": "http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-0843",
    "datePublished": "2009-03-31T18:00:00.000Z",
    "dateReserved": "2009-03-06T00:00:00.000Z",
    "dateUpdated": "2024-08-07T04:48:52.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2009-0843

CVE-2009-0843 (GCVE-0-2009-0843)

Tags

Sightings

Nomenclature

Related by attack behaviour