CVE-2023-50729
Assigner: GitHub_M
Published: 2024-01-15T15:57:27.575Z
State: PUBLISHED
title: An unrestricted file upload vulnerability in traccar leads to RCE
problemTypes: descriptions: cweId: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
affected: vendor: traccar
product: traccar
versions: version: < 5.11
status: affected
descriptions: value: Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent because Traccar is recommended to run web servers as root user. It is also more dangerous because it can write or overwrite files in arbitrary locations.  Version 5.11 was published to fix this vulnerability.
source: advisory: GHSA-pqf7-8g85-vx2q
discovery: UNKNOWN