CVE-2024-24809: Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type
Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix device. under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24809?
CVE-2024-24809 is considered a high severity vulnerability due to its potential for exploitation through path traversal and unrestricted file uploads.
How do I fix CVE-2024-24809?
To fix CVE-2024-24809, upgrade Traccar to version 6.0 or later, which includes patches for these vulnerabilities.
What types of attacks can exploit CVE-2024-24809?
CVE-2024-24809 can be exploited through path traversal attacks and the upload of potentially dangerous file types.
Which versions of Traccar are affected by CVE-2024-24809?
Traccar versions prior to 6.0 are affected by CVE-2024-24809.
Is user registration necessary for exploiting CVE-2024-24809?
Yes, attackers need to register an account to gain ordinary user permissions, facilitating the exploitation of CVE-2024-24809.