CVE-2021-21292: Unquoted Windows binary path in Traccar
Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are impacted. Attacker needs write access to the filesystem on the host machine. If Java path includes a space, then attacker can lift their privilege to the same as Traccar service (system). This is fixed in version 4.12.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-21292?
CVE-2021-21292 is classified as a high severity vulnerability due to the potential for file system exploitation on impacted systems.
How do I fix CVE-2021-21292?
To mitigate CVE-2021-21292, upgrade Traccar to version 4.12 or later to ensure the vulnerability is patched.
Which systems are affected by CVE-2021-21292?
CVE-2021-21292 affects only Windows systems running Traccar versions prior to 4.12.
Can an attacker exploit CVE-2021-21292 remotely?
Exploitation of CVE-2021-21292 requires that the attacker has write access to the filesystem on the host machine.
What is the nature of the vulnerability in CVE-2021-21292?
CVE-2021-21292 is an unquoted Windows binary path vulnerability that can lead to arbitrary code execution.