CVE-2024-24809

HIGH Year: 2024
CVSS v3 Score
8.5
High
Weakness Type
CWE-27
View all →

Vulnerability Description

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.

Related Vulnerabilities

CVE-2024-21896

HIGH
CVSS:7.9(High)

The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.f...

CWE-272024

CVE-2021-35027

HIGH
CVSS:7.5(High)

A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access to sensitive information.

CWE-272021

CVE-2024-20348

HIGH
CVSS:7.5(High)

A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to read arbitrary files. This vul...

CWE-272024

CVE-2024-7458

MEDIUM
CVSS:9.8(Critical)

A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /api/database/upload of the component Databa...

CWE-272024

CVE-2023-20090

MEDIUM
CVSS:6.7(Medium)

A vulnerability in Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to improper access contr...

CWE-272023

CVE-2024-7458

MEDIUM
CVSS:9.8(Critical)

A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /api/database/upload of the component Databa...

CWE-272024