CVE-2024-24809
HIGHCVSS v3
8.5
HIGH
EPSS Score
90.8%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.
Technical Details
- Published
- 4/10/2024
Frequently Asked Questions
What is CVE-2024-24809?
Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.
Is CVE-2024-24809 actively exploited?
Active exploitation of CVE-2024-24809 has not been confirmed. The EPSS score is 90.8%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2024-24809?
CVE-2024-24809 has a CVSS v3 base score of 8.5 (HIGH severity).
Is CVE-2024-24809 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.