Lucene search
MitreCVE-2013-7262HistoryJan 05, 2014 - 8:55 p.m.
CVE-2013-7262
2014-01-0520:55:04
CWE-89
mitre
web.nvd.nist.gov
32
2
cve-2013-7262
sql injection
mspostgislayersettimefilter
mapserver
nvd
vulnerability
wms-time service
remote attackers
arbitrary sql commands
CVSS2
6.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
AI Score
8.2
Confidence
Low
EPSS
0.002
Percentile
52.5%
SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter.
Affected configurations
Node
osgeomapserverRange≤6.4.0
ORosgeomapserverMatch4.2.0beta1
ORosgeomapserverMatch4.4.0
ORosgeomapserverMatch4.4.0beta1
ORosgeomapserverMatch4.4.0beta2
ORosgeomapserverMatch4.4.0beta3
ORosgeomapserverMatch4.6.0
ORosgeomapserverMatch4.6.0beta1
ORosgeomapserverMatch4.6.0beta2
ORosgeomapserverMatch4.6.0beta3
ORosgeomapserverMatch4.6.0rc1
ORosgeomapserverMatch4.8.0beta1
ORosgeomapserverMatch4.8.0beta2
ORosgeomapserverMatch4.8.0beta3
ORosgeomapserverMatch4.8.0rc1
ORosgeomapserverMatch4.8.0rc2
ORosgeomapserverMatch4.10.0
ORosgeomapserverMatch4.10.0beta1
ORosgeomapserverMatch4.10.0beta2
ORosgeomapserverMatch4.10.0beta3
ORosgeomapserverMatch4.10.0rc1
ORosgeomapserverMatch4.10.1
ORosgeomapserverMatch4.10.2
ORosgeomapserverMatch4.10.3
ORosgeomapserverMatch4.10.4
ORosgeomapserverMatch4.10.5
ORosgeomapserverMatch5.0.0
ORosgeomapserverMatch5.0.0beta1
ORosgeomapserverMatch5.0.0beta2
ORosgeomapserverMatch5.0.0beta3
ORosgeomapserverMatch5.0.0beta4
ORosgeomapserverMatch5.0.0beta5
ORosgeomapserverMatch5.0.0beta6
ORosgeomapserverMatch5.0.0rc1
ORosgeomapserverMatch5.0.0rc2
ORosgeomapserverMatch5.2.0
ORosgeomapserverMatch5.2.0beta1
ORosgeomapserverMatch5.2.0beta2
ORosgeomapserverMatch5.2.0beta3
ORosgeomapserverMatch5.2.0beta4
ORosgeomapserverMatch5.2.0rc1
ORosgeomapserverMatch5.2.1
ORosgeomapserverMatch5.4.0
ORosgeomapserverMatch5.4.0beta1
ORosgeomapserverMatch5.4.0beta2
ORosgeomapserverMatch5.4.0beta3
ORosgeomapserverMatch5.4.0beta4
ORosgeomapserverMatch5.4.0rc1
ORosgeomapserverMatch5.4.0rc2
ORosgeomapserverMatch5.4.1
ORosgeomapserverMatch5.4.2
ORosgeomapserverMatch5.6.0
ORosgeomapserverMatch5.6.1
ORosgeomapserverMatch5.6.3
ORosgeomapserverMatch6.0.1
ORosgeomapserverMatch6.0.2
ORosgeomapserverMatch6.0.3
ORosgeomapserverMatch6.2.0
ORosgeomapserverMatch6.2.1
ORumnmapserverMatch5.2.3
ORumnmapserverMatch5.6.7
ORumnmapserverMatch6.0.0
| Vendor | Product | Version | CPE |
|---|---|---|---|
| osgeo | mapserver | * | cpe:2.3:a:osgeo:mapserver:*:*:*:*:*:*:*:* |
| osgeo | mapserver | 4.2.0 | cpe:2.3:a:osgeo:mapserver:4.2.0:beta1:*:*:*:*:*:* |
| osgeo | mapserver | 4.4.0 | cpe:2.3:a:osgeo:mapserver:4.4.0:*:*:*:*:*:*:* |
| osgeo | mapserver | 4.4.0 | cpe:2.3:a:osgeo:mapserver:4.4.0:beta1:*:*:*:*:*:* |
| osgeo | mapserver | 4.4.0 | cpe:2.3:a:osgeo:mapserver:4.4.0:beta2:*:*:*:*:*:* |
| osgeo | mapserver | 4.4.0 | cpe:2.3:a:osgeo:mapserver:4.4.0:beta3:*:*:*:*:*:* |
| osgeo | mapserver | 4.6.0 | cpe:2.3:a:osgeo:mapserver:4.6.0:*:*:*:*:*:*:* |
| osgeo | mapserver | 4.6.0 | cpe:2.3:a:osgeo:mapserver:4.6.0:beta1:*:*:*:*:*:* |
| osgeo | mapserver | 4.6.0 | cpe:2.3:a:osgeo:mapserver:4.6.0:beta2:*:*:*:*:*:* |
| osgeo | mapserver | 4.6.0 | cpe:2.3:a:osgeo:mapserver:4.6.0:beta3:*:*:*:*:*:* |
References
Social References
More
Related
seebug
seebug
MapServer PostGIS TIME Filter SQL注入漏洞
2014-01-07 00:00:00
fedora
fedora
[SECURITY] Fedora 21 Update: mapserver-6.2.2-1.fc21
2015-03-19 18:39:47
[SECURITY] Fedora 20 Update: mapserver-6.2.2-1.fc20
2015-03-19 18:42:57
nessus
nessus
Fedora 20 : mapserver-6.2.2-1.fc20 (2014-17559)
2015-03-20 00:00:00
MapServer < 5.6.9 / 6.0.4 / 6.2.2 / 6.4.1 SQL Injection
2014-01-22 00:00:00
Fedora 21 : mapserver-6.2.2-1.fc21 (2014-17567)
2015-03-20 00:00:00
openvas
openvas
Mageia: Security Advisory (MGASA-2015-0097)
2022-01-28 00:00:00
Fedora Update for mapserver FEDORA-2014-17567
2015-03-20 00:00:00
Fedora Update for mapserver FEDORA-2014-17559
2015-03-20 00:00:00
debiancve
debiancve
CVE-2013-7262
2014-01-05 20:55:04
cvelist
cvelist
CVE-2013-7262
2014-01-05 20:00:00
ubuntucve
ubuntucve
CVE-2013-7262
2014-01-05 00:00:00
mageia
mageia
Updated mapserver packages fix CVE-2013-7262 and packaging issues
2015-03-06 21:08:57
prion
prion
Sql injection
2014-01-05 20:55:00
nvd
nvd
CVE-2013-7262
2014-01-05 20:55:04
CVSS2
6.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
AI Score
8.2
Confidence
Low
EPSS
0.002
Percentile
52.5%
Related for CVE-2013-7262