CVE-2007-4542: XSS
First published: Mon Aug 27 2007(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in MapServer before 4.10.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the (1) processLine function in maptemplate.c and the (2) writeError function in mapserv.c in the mapserv CGI program.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| University Of Minnesota Mapserver | <=4.10.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=439346
- http://trac.osgeo.org/mapserver/attachment/ticket/2256/ms-bug-2256-4.8.patch
- http://trac.osgeo.org/mapserver/ticket/2256
- http://secunia.com/advisories/26561
- http://mapserver.gis.umn.edu/download/current/HISTORY.TXT/
- https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00096.html
- http://www.securityfocus.com/bid/25582
- http://secunia.com/advisories/26718
- http://www.debian.org/security/2008/dsa-1539
- http://secunia.com/advisories/29688
- http://www.vupen.com/english/advisories/2007/2974
Frequently Asked Questions
What is the severity of CVE-2007-4542?
CVE-2007-4542 has been classified with a low to medium severity due to its potential for cross-site scripting attacks.
How do I fix CVE-2007-4542?
To fix CVE-2007-4542, upgrade to MapServer version 4.10.4 or later to ensure vulnerabilities are patched.
What types of attacks can CVE-2007-4542 allow?
CVE-2007-4542 allows remote attackers to conduct cross-site scripting attacks by injecting arbitrary web scripts or HTML into the application.
Which versions of MapServer are affected by CVE-2007-4542?
CVE-2007-4542 affects MapServer versions before 4.10.3.
What are the vectors involved in CVE-2007-4542?
The vectors involved in CVE-2007-4542 include unspecified inputs to the processLine function in maptemplate.c and the writeError function in mapserv.c.
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/remedy
- agent/first-publish-date
- agent/tags
- agent/event
- agent/description
- agent/source
- vendor/university of minnesota
- canonical/university of minnesota mapserver
- version/university of minnesota mapserver/4.10.3