CVE-2021-32062

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNORAZCJ7AIPJFUY6WGLYIA3QVPWFXFY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVWUC4EOW5WZAZGPLRTZS5QXNUEBPQ5/
https://mapserver.org/development/changelog/changelog-7-0.htmlRelease Notes, Vendor Advisory
https://mapserver.org/development/changelog/changelog-7-2.htmlRelease Notes, Vendor Advisory
https://mapserver.org/development/changelog/changelog-7-4.htmlRelease Notes, Vendor Advisory
https://mapserver.org/development/changelog/changelog-7-6.htmlRelease Notes, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNORAZCJ7AIPJFUY6WGLYIA3QVPWFXFY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVWUC4EOW5WZAZGPLRTZS5QXNUEBPQ5/
https://mapserver.org/development/changelog/changelog-7-0.htmlRelease Notes, Vendor Advisory
https://mapserver.org/development/changelog/changelog-7-2.htmlRelease Notes, Vendor Advisory
https://mapserver.org/development/changelog/changelog-7-4.htmlRelease Notes, Vendor Advisory
https://mapserver.org/development/changelog/changelog-7-6.htmlRelease Notes, Vendor Advisory

Timeline

Published: May 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-320667.4An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartT CVE-2021-320676.5The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an H CVE-2021-320683.7The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by CVE-2021-320694.8The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation CVE-2021-320705.4The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecu CVE-2021-320719.8The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access co CVE-2021-320726.5The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensit CVE-2021-320738.8DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remo CVE-2021-320747.5HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a mult CVE-2021-320759.8Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization.CVE-2021-320765.3Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Ge CVE-2021-320777.5Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number