PT-2021-14394 · Traccar · Traccar

Lowtananaev · Published 2021-02-02 · Updated 2021-02-08 · CVE-2021-21292

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Traccar versions prior to 4.12

Description: Traccar is an open source GPS tracking system. The issue is an unquoted Windows binary path vulnerability, which impacts only Windows versions. An attacker needs write access to the filesystem on the host machine to exploit this. If the Java path includes a space, the attacker can elevate their privilege to the same level as the Traccar service, which is system-level.

Recommendations: For versions prior to 4.12, update to version 4.12 to resolve the issue. As a temporary workaround, consider restricting write access to the filesystem on the host machine to minimize the risk of exploitation. Additionally, ensure the Java path does not include any spaces to prevent privilege elevation.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2021-21292

GHSA-J75R-7QM5-62Q5

Affected Products

Traccar

References · 6

• https://github.com/traccar/traccar/commit/cc69a9907ac9878db3750aa14ffedb28626455da · Patch
• https://osv.dev/vulnerability/CVE-2021-21292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21292 · Security Note
• https://github.com/traccar/traccar/security/advisories/GHSA-j75r-7qm5-62q5 · Note
• https://traccar.org · Note
• https://t.me/cibsecurity/22965 · Telegram Post