PT-2024-13959 · Traccar · Traccar

Isacaya · Published 2024-01-15 · Updated 2024-01-19 · CVE-2023-50729

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Traccar versions prior to 5.11

Description Traccar, an open source GPS tracking system, is affected by an unrestricted file upload vulnerability in the File feature. This allows attackers to execute arbitrary code on the server. The issue is more prevalent due to the recommendation to run Traccar web servers as the root user, making it more dangerous as it can write or overwrite files in arbitrary locations.

Recommendations For versions prior to 5.11, update to version 5.11 to fix the vulnerability. As a temporary workaround, consider restricting access to the File feature until the update is applied.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-50729

GHSA-PQF7-8G85-VX2Q

Affected Products

Traccar

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50729.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-50729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50729 · Security Note
• https://github.com/traccar/traccar/security/advisories/GHSA-pqf7-8g85-vx2q · Note
• https://twitter.com/VulmonFeeds/status/1746947347739820256 · Twitter Post
• https://twitter.com/CVEnew/status/1746930289710878969 · Twitter Post