{"id":"CVE-2021-32062","details":"MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI).","modified":"2026-07-08T05:59:42.961716081Z","published":"2021-05-06T13:15:12.723Z","related":["openSUSE-SU-2024:11037-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"33"},{"last_affected":"33"},{"introduced":"34"},{"last_affected":"34"}]}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNORAZCJ7AIPJFUY6WGLYIA3QVPWFXFY/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVWUC4EOW5WZAZGPLRTZS5QXNUEBPQ5/"},{"type":"ADVISORY","url":"https://mapserver.org/development/changelog/changelog-7-0.html"},{"type":"ADVISORY","url":"https://mapserver.org/development/changelog/changelog-7-2.html"},{"type":"ADVISORY","url":"https://mapserver.org/development/changelog/changelog-7-4.html"},{"type":"ADVISORY","url":"https://mapserver.org/development/changelog/changelog-7-6.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mapserver/mapserver","events":[{"introduced":"0"},{"fixed":"cb59297fad33d8d2498f74be2c0cba5522694201"},{"fixed":"7801801a7bdbb84f37bfbee0a9d19a64156d84d6"},{"fixed":"772bd6f3d6d344ca55e893c707763c21e00561a8"},{"fixed":"7c0572445549e176a76502e381cf936f62f1266f"}],"database_specific":{"cpe":"cpe:2.3:a:osgeo:mapserver:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"7.0.8"},{"introduced":"7.1.0"},{"fixed":"7.2.3"},{"introduced":"7.3.0"},{"fixed":"7.4.5"},{"introduced":"7.5.0"},{"fixed":"7.6.3"}],"source":"CPE_RANGE"}}],"versions":["rel-7-6-2","rel-7-4-4","rel-7-6-1","rel-7-6-0","rel-7-6-0-rc4","rel-7-6-0-rc3","rel-7-6-0-rc2","rel-7-6-0-rc1","rel-7-6-0-beta2","rel-7-6-0-beta1","rel-7-4-3","rel-7-2-2","rel-7-4-2","rel-7-4-1","rel-7-4-0","rel-7-4-0-rc2","rel-7-4-0-rc1","rel-7-4-0-beta2","rel-7-4-0-beta1","rel-7-2-1","rel-7-2-0","rel-7-2-0-beta2","rel-7-2-0-beta1","rel-7-0-7","rel-7-0-6","rel-7-0-5","rel-7-0-4","rel-7-0-3","rel-7-0-2","rel-7-0-1","rel-7-0-0","rel-7-0-0-beta2","rel-7-0-0-beta1","rel-6-4-0","rel-6-4-0-rc1","rel-6-4-0-beta2","rel-6-4-0-beta1","rel-4-10-0","rel-4-10-0-rc1","rel-4-10-0-beta3","rel-4-10-0-beta2","rel-4-10-0-beta1","rel-4-8-0-rc2","rel-4-8-0-beta3","rel-4-8-0-beta2","rel-4-8-0-beta1","rel-4-6-0","rel-4-6-0-rc1","rel-4-6-0-beta3","rel-4-6-0-beta2","rel-4-6-0-beta1","rel-4-4-0","rel-4-4-0-beta3","rel-4-4-0-beta2","rel-4-4-0-beta1","rel-4-0-0","styleObj","rel-3-5-0","rel-3-4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32062.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}