CVE-2020-5246 - CVE House
Back to Database
Status published High CVE-2020-5246

LDAP injection vulnerability in Traccar GPS Tracking System

Vulnerability Description

Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of the LDAP query and get admin privileges. The issue only impacts instances with LDAP configuration and where users can craft their own names. This has been patched in version 4.9.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5246

Credits & Attribution

No credits recorded in the NVD database.

References

More from Traccar

View All →
CVE-2024-7746
Use of default credentials at Traccar fleet management solution
Critical 9.5

Affected Vendor

Affected Software

Traccar
Vulnerable Versions:
< 4.9

Timeline

Official Publish: July 14th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Weaknesses (CWE)

CWE-90

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.