CVE-2009-0843 Information disclosure in n/a
Remote attackers can determine the existence of arbitrary files on the server by analyzing error messages triggered by the queryfile parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-0843?
CVE-2009-0843 is a high-severity vulnerability in n/a, published on 31 Mar 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
Weakness: CWE-20
Which versions are affected by CVE-2009-0843?
It affects 2 products.
Products include Osgeo Mapserver, Umn Mapserver.
How do I fix CVE-2009-0843?
Upgrade to a fixed version.
Is CVE-2009-0843 being exploited?
There is no known exploitation of CVE-2009-0843 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2009-0843, GHSA-q85f-4wpm-qqjc.