CVE-2011-2703

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-08-01 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.

Affected products

MapServer: through 4.10.6; 4.2.0-beta1, 4.4.0, 4.4.0-beta1, 4.4.0-beta2, 4.4.0-beta3, 4.6.0 (+47)
Umn Mapserver: 5.2.2, 5.2.3, 5.6.4, 5.6.5, 5.6.6, 6.0.0 (+9)

References

http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html
http://secunia.com/advisories/45257
http://secunia.com/advisories/45318
http://secunia.com/advisories/45368
http://trac.osgeo.org/mapserver/ticket/3903
http://www.debian.org/security/2011/dsa-2285
http://www.openwall.com/lists/oss-security/2011/07/19/11
http://www.openwall.com/lists/oss-security/2011/07/19/14
http://www.openwall.com/lists/oss-security/2011/07/20/15
http://www.securityfocus.com/bid/48720
https://bugzilla.redhat.com/show_bug.cgi?id=722545
https://bugzilla.redhat.com/show_bug.cgi?id=723293

Get alerted when CVE-2011-2703 or the next vulnerability affects your stack