CVE-2011-2703

Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.

Published Bysecalert@redhat.com

Published DateAug 01, 2011, 19:55

Weakness Type (CWE):CWE-89

CVSS Metrics

Base Score

7.5

Vector String

AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html
http://secunia.com/advisories/45257
http://secunia.com/advisories/45318
http://secunia.com/advisories/45368
http://trac.osgeo.org/mapserver/ticket/3903
http://www.debian.org/security/2011/dsa-2285
http://www.openwall.com/lists/oss-security/2011/07/19/11
http://www.openwall.com/lists/oss-security/2011/07/19/14
http://www.openwall.com/lists/oss-security/2011/07/20/15
http://www.securityfocus.com/bid/48720
https://bugzilla.redhat.com/show_bug.cgi?id=722545
https://bugzilla.redhat.com/show_bug.cgi?id=723293
https://exchange.xforce.ibmcloud.com/vulnerabilities/68682

Weakness Type (CWE):CWE-89

CVSS Metrics

Base Score

7.5

Vector String

AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL