CVE-2010-2540 Security feature bypass in n/a
Remote attackers can bypass security restrictions by exploiting improperly restricted debugging CGI arguments in MapServer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-2540?
CVE-2010-2540 is a critical vulnerability in n/a, published on 2 Aug 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which allows remote attackers to have an unspecified impact via crafted arguments.
Weakness: CWE-264
Which versions are affected by CVE-2010-2540?
It affects 2 products.
Products include Osgeo Mapserver, Umn Mapserver.
How do I fix CVE-2010-2540?
Upgrade to a fixed version.
Is CVE-2010-2540 being exploited?
There is no known exploitation of CVE-2010-2540 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2010-2540, GHSA-rvf8-gfc4-3j6f.