CVE-2009-0843
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows...
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
Exploit likelihood
What each source reports
NVD Score used
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
- Record
CVE-2009-0843- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:C/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
- Record
CVE-2009-0843- Updated
- 2026-11-02
EUVDEUVD-2009-0840 No score
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
- Record
EUVD-2009-0840- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q85f-4wpm-qqjc No score
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows...
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
- Record
GHSA-q85f-4wpm-qqjc- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
- Record
CVE-2009-0843- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-0843 No score
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
- Record
DEBIAN-CVE-2009-0843- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mapserverDebian:12 |
before 5.2.2-1 | 5.2.2-1 |
mapserverDebian:13 |
before 5.2.2-1 | 5.2.2-1 |
mapserverDebian:14 |
before 5.2.2-1 | 5.2.2-1 |
mapserverDebian:4.0 |
before 4.10.0-5.1+etch4, plus listed versions 4.10.0-5+etch14.10.0-5.1+etch2 |
4.10.0-5.1+etch4 |
mapserverDebian:5.0 |
before 5.0.3-3+lenny4, plus listed versions 5.0.3-3 |
5.0.3-3+lenny4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0843 is a high vulnerability (CVSS 7.8) in Osgeo Mapserver, published March 31, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.13%, the 87th percentile. Fixed in mapserver 5.2.2-1.
References
positronsecurity.com/advisories/2009-000.html
trac.osgeo.org/mapserver/ticket/2939
securitytracker.com/id?1021952
securityfocus.com/archive/1/502271/100/0/threaded
secunia.com/advisories/34603
redhat.com/archives/fedora-package-announce/2009-April/msg00170.html
Show 8 moreShow less
debian.org/security/2009/dsa-1914
lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html
nvd.nist.gov/vuln/detail/CVE-2009-0843
github.com/advisories/GHSA-q85f-4wpm-qqjc
security-tracker.debian.org/tracker/CVE-2009-0843