CVE-2021-32062

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-06 · updated 2026-06-17
Weakness: CWE-22

Description

MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded (with MapServer CGI).

Affected products

Fedoraproject Fedora: 33, 34
MapServer: before 7.0.8; from 7.1.0 before 7.2.3; from 7.3.0 before 7.4.5; from 7.5.0 before 7.6.3 — fixed in 7.0.8, 7.2.3, 7.4.5, 7.6.3

How to fix

Upgrade to a fixed version: MapServer 7.0.8, 7.2.3, 7.4.5, 7.6.3. Check the vendor advisory for mitigations.

References

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNORAZCJ7AIPJFUY6WGLYIA3QVPWFXFY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVWUC4EOW5WZAZGPLRTZS5QXNUEBPQ5/
https://mapserver.org/development/changelog/changelog-7-0.html
https://mapserver.org/development/changelog/changelog-7-2.html
https://mapserver.org/development/changelog/changelog-7-4.html
https://mapserver.org/development/changelog/changelog-7-6.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNORAZCJ7AIPJFUY6WGLYIA3QVPWFXFY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVWUC4EOW5WZAZGPLRTZS5QXNUEBPQ5/
https://mapserver.org/development/changelog/changelog-7-0.html
https://mapserver.org/development/changelog/changelog-7-2.html
https://mapserver.org/development/changelog/changelog-7-4.html
https://mapserver.org/development/changelog/changelog-7-6.html

Get alerted when CVE-2021-32062 or the next vulnerability affects your stack