CVE-2026-42030

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42030", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-23T16:05:01.708Z", "datePublished": "2026-05-08T15:56:48.553Z", "dateUpdated": "2026-05-08T21:26:45.294Z"}, "containers": {"cna": {"title": "MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer", "problemTypes": [{"descriptions": [{"cweId": "CWE-80", "lang": "en", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x"}, {"name": "https://github.com/MapServer/MapServer/releases/tag/rel-8-6-2", "tags": ["x_refsource_MISC"], "url": "https://github.com/MapServer/MapServer/releases/tag/rel-8-6-2"}], "affected": [{"vendor": "MapServer", "product": "MapServer", "versions": [{"version": ">= 6.0, < 8.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T15:56:48.553Z"}, "descriptions": [{"lang": "en", "value": "MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2."}], "source": {"advisory": "GHSA-4g9f-ph64-hg2x", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T17:12:03.204167Z", "id": "CVE-2026-42030", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T21:26:45.294Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42030", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T17:12:03.204167Z"}}}], "references": [{"url": "https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T17:12:13.321Z"}}], "cna": {"title": "MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer", "source": {"advisory": "GHSA-4g9f-ph64-hg2x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "MapServer", "product": "MapServer", "versions": [{"status": "affected", "version": ">= 6.0, < 8.6.2"}]}], "references": [{"url": "https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x", "name": "https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/MapServer/MapServer/releases/tag/rel-8-6-2", "name": "https://github.com/MapServer/MapServer/releases/tag/rel-8-6-2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T15:56:48.553Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42030", "state": "PUBLISHED", "dateUpdated": "2026-05-08T21:26:45.294Z", "dateReserved": "2026-04-23T16:05:01.708Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T15:56:48.553Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "MapServer", "vendor": "MapServer", "versions": [{"status": "affected", "version": ">= 6.0, < 8.6.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:osgeo:mapserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "840C5065-B8B0-4669-B557-1233B23084C6", "versionEndExcluding": "8.6.2", "versionStartIncluding": "6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2."}, {"lang": "es", "value": "MapServer es un sistema para desarrollar aplicaciones GIS basadas en web. Desde la versi\u00f3n 6.0 hasta antes de la versi\u00f3n 8.6.2, una vulnerabilidad XSS reflejada en el servidor WMS de MapServer permite a un atacante no autenticado inyectar HTML/JavaScript arbitrario en el navegador de cualquier usuario que abre una URL WMS manipulada. La vulnerabilidad se activa a trav\u00e9s de FORMAT=application/openlayers combinado con un par\u00e1metro SRS no saneado en solicitudes WMS 1.3.0. Este problema ha sido parcheado en la versi\u00f3n 8.6.2."}], "id": "CVE-2026-42030", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42030", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-08T17:12:03.204167Z", "version": "2.0.3"}}]}, "published": "2026-05-08T17:16:31.307", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/MapServer/MapServer/releases/tag/rel-8-6-2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.0,8.6.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MapServer", "source": "cna", "vendor": "MapServer"}, "product": "mapserver", "vendor": "mapserver"}], "created": "2026-05-08T19:15:14.825304+00:00", "updated": "2026-05-08T22:45:05.160086+00:00", "vendors": ["mapserver", "mapserver$PRODUCT$mapserver"]}