CVE-2021-32062

Name of the Vulnerable Software and Affected Versions: MapServer versions 7.0.0 through 7.0.7 MapServer versions 7.1.x MapServer versions 7.2.x through 7.2.2 MapServer versions 7.3.x MapServer versions 7.4.x through 7.4.4 MapServer versions 7.5.x MapServer versions 7.6.x through 7.6.2

Description: The issue arises from the improper enforcement of MS MAP NO PATH and MS MAP PATTERN restrictions, which are intended to control the locations from which a mapfile may be loaded when using MapServer CGI.

Recommendations: For MapServer versions 7.0.0 through 7.0.7, update to version 7.0.8 or later. For MapServer versions 7.1.x, update to version 7.2.3 or later. For MapServer versions 7.2.x through 7.2.2, update to version 7.2.3 or later. For MapServer versions 7.3.x, update to version 7.4.5 or later. For MapServer versions 7.4.x through 7.4.4, update to version 7.4.5 or later. For MapServer versions 7.5.x, update to version 7.6.3 or later. For MapServer versions 7.6.x through 7.6.2, update to version 7.6.3 or later.