Mapserver
Monthly
Unauthenticated SQL injection in MapServer 8.4.0 through 8.6.3 lets remote attackers who can reach a PostGIS-backed query endpoint inject arbitrary SQL fragments into the generated PostgreSQL predicate, bypassing record-level filters and enumerating data they should not see. The flaw is reachable via the CGI qstring filter or an OGC API Features featureId path segment when a layer is configured with CONNECTIONTYPE POSTGIS and numeric item metadata such as gml_<item>_type=Integer; the unquoted value is concatenated straight into the SQL statement. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L vector, confidentiality impact is high while integrity is unaffected, meaning successful exploitation yields predicate bypass, unintended-record enumeration, and blind boolean- or time-based extraction rather than database modification, with a modest availability cost from increased database load; no public exploit code and no confirmed active exploitation were identified at time of analysis, and version 8.6.4 fixes the issue.
Denial of service in MapServer 6.4.0 through 8.6.2 allows remote unauthenticated attackers to crash the server by submitting a small well-formed SLD document via the WMS SLD_BODY= parameter. The flaw is a NULL pointer dereference reached when an SLD <Rule> carries <ElseFilter/> but defines no symbolizer, causing the styling code to index a class array at position -1. No public exploit has been identified at time of analysis, and the issue is fixed in version 8.6.3.
Reflected cross-site scripting (CWE-79) in MapServer's OpenLayers HTML output affects versions 6.0 through 8.6.3 and is fixed in 8.6.4. When a deployment trusts the X-Forwarded-Host header and does not pin a fixed ows_onlineresource metadata value or MS_ONLINERESOURCE environment variable, an unauthenticated remote attacker can supply a host value containing embedded single quotes that escapes the single-quoted JavaScript URL emitted for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers; a victim who opens the crafted link executes attacker-controlled JavaScript in the MapServer site origin, exposing sessions or tokens, same-origin data and requests, and actions as the victim. Impact is confined to the victim's browser session on the MapServer origin rather than the server itself, and exploitation is constrained by the non-default configuration prerequisite and by the need for user interaction, so the assessed risk is moderate; no public exploit identified at time of analysis and CVSS is 5.3.
Reflected XSS in MapServer 6.0 through 8.6.1 allows unauthenticated remote attackers to inject arbitrary HTML and JavaScript into the browsers of users clicking crafted WMS URLs. The vulnerability exists in the OpenLayers template when FORMAT=application/openlayers is combined with an unsanitized SRS parameter in WMS 1.3.0 requests. MapServer 8.6.2 patches this issue, and no public exploit code or active exploitation has been confirmed, though the attack requires user interaction (clicking a malicious link).
MapServer versions 4.2 through 8.6.0 are vulnerable to a heap buffer overflow in the SLD (Styled Layer Descriptor) parser that allows remote, unauthenticated attackers to crash the MapServer process by sending a crafted SLD document containing more than 100 Threshold elements within a ColorMap/Categorize structure. The vulnerability is reachable via WMS GetMap requests using the SLD_BODY parameter, requiring no authentication or user interaction. Vendor-released patch: version 8.6.1 eliminates the issue; no public exploit code or active exploitation has been identified at time of analysis.
MapServer is a system for developing web-based GIS applications. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Unauthenticated SQL injection in MapServer 8.4.0 through 8.6.3 lets remote attackers who can reach a PostGIS-backed query endpoint inject arbitrary SQL fragments into the generated PostgreSQL predicate, bypassing record-level filters and enumerating data they should not see. The flaw is reachable via the CGI qstring filter or an OGC API Features featureId path segment when a layer is configured with CONNECTIONTYPE POSTGIS and numeric item metadata such as gml_<item>_type=Integer; the unquoted value is concatenated straight into the SQL statement. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L vector, confidentiality impact is high while integrity is unaffected, meaning successful exploitation yields predicate bypass, unintended-record enumeration, and blind boolean- or time-based extraction rather than database modification, with a modest availability cost from increased database load; no public exploit code and no confirmed active exploitation were identified at time of analysis, and version 8.6.4 fixes the issue.
Denial of service in MapServer 6.4.0 through 8.6.2 allows remote unauthenticated attackers to crash the server by submitting a small well-formed SLD document via the WMS SLD_BODY= parameter. The flaw is a NULL pointer dereference reached when an SLD <Rule> carries <ElseFilter/> but defines no symbolizer, causing the styling code to index a class array at position -1. No public exploit has been identified at time of analysis, and the issue is fixed in version 8.6.3.
Reflected cross-site scripting (CWE-79) in MapServer's OpenLayers HTML output affects versions 6.0 through 8.6.3 and is fixed in 8.6.4. When a deployment trusts the X-Forwarded-Host header and does not pin a fixed ows_onlineresource metadata value or MS_ONLINERESOURCE environment variable, an unauthenticated remote attacker can supply a host value containing embedded single quotes that escapes the single-quoted JavaScript URL emitted for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers; a victim who opens the crafted link executes attacker-controlled JavaScript in the MapServer site origin, exposing sessions or tokens, same-origin data and requests, and actions as the victim. Impact is confined to the victim's browser session on the MapServer origin rather than the server itself, and exploitation is constrained by the non-default configuration prerequisite and by the need for user interaction, so the assessed risk is moderate; no public exploit identified at time of analysis and CVSS is 5.3.
Reflected XSS in MapServer 6.0 through 8.6.1 allows unauthenticated remote attackers to inject arbitrary HTML and JavaScript into the browsers of users clicking crafted WMS URLs. The vulnerability exists in the OpenLayers template when FORMAT=application/openlayers is combined with an unsanitized SRS parameter in WMS 1.3.0 requests. MapServer 8.6.2 patches this issue, and no public exploit code or active exploitation has been confirmed, though the attack requires user interaction (clicking a malicious link).
MapServer versions 4.2 through 8.6.0 are vulnerable to a heap buffer overflow in the SLD (Styled Layer Descriptor) parser that allows remote, unauthenticated attackers to crash the MapServer process by sending a crafted SLD document containing more than 100 Threshold elements within a ColorMap/Categorize structure. The vulnerability is reachable via WMS GetMap requests using the SLD_BODY parameter, requiring no authentication or user interaction. Vendor-released patch: version 8.6.1 eliminates the issue; no public exploit code or active exploitation has been identified at time of analysis.
MapServer is a system for developing web-based GIS applications. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.