An unrestricted file upload vulnerability in traccar leads to RCE
CVE-2023-50729

8.5HIGH

Key Information:

Vendor

Traccar

Status
Traccar
Vendor
CVE Published:
15 January 2024

What is CVE-2023-50729?

Traccar is an open-source GPS tracking system that prior to version 5.11 is susceptible to an unrestricted file upload vulnerability. This issue enables attackers to upload malicious files, potentially leading to arbitrary code execution on the server. The risk intensifies as Traccar is often run on web servers with root user privileges, granting extensive access that could be exploited. Additionally, the vulnerability permits writing or overwriting files in arbitrary locations, increasing the potential for exploitation. Version 5.11 was released to address this security concern.

Affected Version(s)

traccar < 5.11

References

https://github.com/traccar/traccar/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.