CVE-2018-1000881: Code Injection

Q: What is CVE-2018-1000881?

CVE-2018-1000881 is a vulnerability in Traccar Server version 4.0 and earlier that allows remote code execution through improper control of code generation.

Q: How severe is CVE-2018-1000881?

CVE-2018-1000881 has a severity of 9.8 (Critical).

Q: What software is affected by CVE-2018-1000881?

Traccar Server version 4.0 and earlier is affected by CVE-2018-1000881.

Q: How can CVE-2018-1000881 be exploited?

CVE-2018-1000881 can be exploited via a remote web application request, allowing for remote command execution.

Published Dec 20, 2018

Updated

Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in ComputedAttributesHandler.java that can result in Remote Command Execution. This attack appear to be exploitable via Remote: web application request by a self-registered user. This vulnerability appears to have been fixed in 4.1 and later.

Affected Software

1 affected component

Traccar Server<=4.0

Event History

Dec 20, 2018

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is CVE-2018-1000881?

CVE-2018-1000881 is a vulnerability in Traccar Server version 4.0 and earlier that allows remote code execution through improper control of code generation.

How severe is CVE-2018-1000881?

CVE-2018-1000881 has a severity of 9.8 (Critical).

What software is affected by CVE-2018-1000881?