PT-2020-18341 · Traccar · Traccar Gps Tracking System

Tananaev · Published 2020-07-14 · Updated 2020-07-16 · CVE-2020-5246

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Traccar GPS Tracking System versions prior to 4.9

Description The issue is related to LDAP injection, which occurs when user input is used in LDAP search filters. An attacker can provide specially crafted input to modify the LDAP query logic and gain admin privileges. This issue only affects instances with LDAP configuration where users can create their own names.

Recommendations For versions prior to 4.9, update to version 4.9 to resolve the issue. As a temporary workaround, consider restricting user input in LDAP search filters or limiting user privileges to minimize the risk of exploitation.

Fix

Special Elements Injection

Weakness Enumeration

CWE-90

CWE-74

Related Identifiers

CVE-2020-5246

GHSA-V955-7G22-2P49

Affected Products

Traccar Gps Tracking System

References · 4

• https://github.com/traccar/traccar/commit/e4f6e74e57ab743b65d49ae00f6624a20ca0291e · Patch
• https://osv.dev/vulnerability/CVE-2020-5246 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5246 · Security Note
• https://github.com/traccar/traccar/security/advisories/GHSA-v955-7g22-2p49 · Note