CVE-2017-5522
CriticalSummary
A stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
Risk Assessment
This vulnerability may lead to system crashes or allow attackers to execute arbitrary code remotely, posing a serious security threat to the organization.
Recommendation
It is recommended to update MapServer to the latest version to mitigate this vulnerability and to monitor the system for unauthorized requests.
Other vulnerabilities in MapServer
See all- CVE-2016-9839High
In MapServer before version 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails.
- CVE-2025-59431Critical
MapServer prior to 8.4.1 is vulnerable to Boolean-based SQL injection in the PropertyName directive of the XML Filter Query. Expression checking is bypassed by introducing double quote characters in PropertyName, allowing manipulation of backend database queries. The vulnerability is fixed in 8.4.1.
- CVE-2026-54355Medium
MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim. This issue is fixed in version 8.6.4.
- CVE-2026-54354High
In MapServer prior to 8.6.4, PostGIS filter translation in msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and Integer metadata are configured, but does not verify that attacker-controlled CGI or OGC API Features input is a numeric literal. The unquoted input is concatenated into the SQL predicate, enabling SQL injection.
Original NVD description (English source)
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS