CVE-2021-32062: 
NixOS vulnerability analysis and mitigation

CVE-2021-32062 affects MapServer versions before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3. The vulnerability is related to improper enforcement of MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions that are intended to control the locations from which a mapfile may be loaded when using MapServer CGI (CVE).

The vulnerability exists in MapServer's CGI implementation where the security controls MS_MAP_NO_PATH and MS_MAP_PATTERN, designed to restrict mapfile loading locations, were not properly enforced. This could potentially allow unauthorized access to mapfiles from unintended locations (MapServer Changelog).

If exploited, this vulnerability could allow attackers to bypass security controls intended to restrict mapfile loading locations, potentially leading to unauthorized access to sensitive mapfile configurations (CVE).

The vulnerability affects the MapServer CGI implementation and requires access to the MapServer CGI interface to be exploited. No public exploits have been reported in the wild (Debian Security).

The vulnerability has been patched in MapServer versions 7.0.8, 7.2.3, 7.4.5, and 7.6.3. Users are advised to upgrade to these versions or later to address the security issue. The fix properly enforces the MS_MAP_NO_PATH and MS_MAP_PATTERN restrictions (MapServer Changelog, Debian Security).