CVE-2023-50729

Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent because Traccar is recommended to run web servers as root user. It is also more dangerous because it can write or overwrite files in arbitrary locations. Version 5.11 was published to fix this vulnerability.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/traccar/traccar/security/advisories/GHSA-pqf7-8g85-vx2q	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*

History

19 Jan 2024, 18:03

Type	Values Removed	Values Added
References	~~() https://github.com/traccar/traccar/security/advisories/GHSA-pqf7-8g85-vx2q -~~	() https://github.com/traccar/traccar/security/advisories/GHSA-pqf7-8g85-vx2q - Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~8.4~~	v2 : unknown v3 : 9.8
CPE		cpe:2.3:a:traccar:traccar::::::::
First Time		Traccar traccar Traccar

16 Jan 2024, 13:56

Type	Values Removed	Values Added
Summary		(es) Traccar es un sistema de seguimiento GPS de código abierto. Antes de la versión 5.11, Traccar se ve afectado por una vulnerabilidad de carga de archivos sin restricciones en la función File que permite a los atacantes ejecutar código arbitrario en el servidor. Esta vulnerabilidad es más frecuente porque se recomienda que Traccar ejecute servidores web como usuario root. También es más peligroso porque puede escribir o sobrescribir archivos en ubicaciones arbitrarias. Se publicó la versión 5.11 para corregir esta vulnerabilidad.

15 Jan 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-15 16:15

Updated : 2024-01-19 18:03

NVD link : CVE-2023-50729

Mitre link : CVE-2023-50729

CVE.ORG link : CVE-2023-50729

JSON object : View

Products Affected

traccar

traccar

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2023-50729", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.7}]}, "published": "2024-01-15T16:15:11.960", "references": [{"url": "https://github.com/traccar/traccar/security/advisories/GHSA-pqf7-8g85-vx2q", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent because Traccar is recommended to run web servers as root user. It is also more dangerous because it can write or overwrite files in arbitrary locations. Version 5.11 was published to fix this vulnerability."}, {"lang": "es", "value": "Traccar es un sistema de seguimiento GPS de c\u00f3digo abierto. Antes de la versi\u00f3n 5.11, Traccar se ve afectado por una vulnerabilidad de carga de archivos sin restricciones en la funci\u00f3n File que permite a los atacantes ejecutar c\u00f3digo arbitrario en el servidor. Esta vulnerabilidad es m\u00e1s frecuente porque se recomienda que Traccar ejecute servidores web como usuario root. Tambi\u00e9n es m\u00e1s peligroso porque puede escribir o sobrescribir archivos en ubicaciones arbitrarias. Se public\u00f3 la versi\u00f3n 5.11 para corregir esta vulnerabilidad."}], "lastModified": "2024-01-19T18:03:25.383", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58C539B1-6FB7-424B-825F-C6EE9954956F", "versionEndExcluding": "5.11"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}