CVE-2020-5246

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2020-5246
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-5246.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-5246
Related
  • GHSA-v955-7g22-2p49
Published
2020-07-14T21:15:10.827Z
Modified
2025-11-14T08:40:50.778746Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of the LDAP query and get admin privileges. The issue only impacts instances with LDAP configuration and where users can craft their own names. This has been patched in version 4.9.

References

Affected packages

Git / github.com/traccar/traccar

Affected ranges

Type
GIT
Repo
https://github.com/traccar/traccar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e4f6e74e57ab743b65d49ae00f6624a20ca0291e

Affected versions

v2.*

v2.0
v2.1
v2.10
v2.11
v2.12
v2.2
v2.3
v2.4
v2.5
v2.6
v2.7
v2.8
v2.9

v3.*

v3.0
v3.1
v3.10
v3.11
v3.12
v3.13
v3.14
v3.15
v3.16
v3.17
v3.2
v3.4
v3.5
v3.6
v3.7
v3.8
v3.9

v4.*

v4.0
v4.1
v4.2
v4.3
v4.4
v4.5
v4.6
v4.7
v4.8

Database specific

vanir_signatures

[
    {
        "digest": {
            "line_hashes": [
                "334007866871142267296810456821999767767",
                "69453126284746783107763111571383318761",
                "42328787689587877472863867429994147720",
                "272794836253572855017533534892411808390",
                "63325574234528139003267629928855242672",
                "160549533749129998745250921221417010513",
                "99569567769375087998407040364123912428",
                "24549550584668368624194621896353789378",
                "218074007232483525541396631272850512346",
                "183325986263730029783145769233746546977"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "src/main/java/org/traccar/database/LdapProvider.java"
        },
        "id": "CVE-2020-5246-0303a06c",
        "source": "https://github.com/traccar/traccar/commit/e4f6e74e57ab743b65d49ae00f6624a20ca0291e"
    },
    {
        "digest": {
            "function_hash": "154572393014333480657064171560275536344",
            "length": 543.0
        },
        "signature_type": "Function",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "src/main/java/org/traccar/database/LdapProvider.java",
            "function": "isAdmin"
        },
        "id": "CVE-2020-5246-293a1112",
        "source": "https://github.com/traccar/traccar/commit/e4f6e74e57ab743b65d49ae00f6624a20ca0291e"
    },
    {
        "digest": {
            "function_hash": "337472206264722884713443513786774421057",
            "length": 569.0
        },
        "signature_type": "Function",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "src/main/java/org/traccar/database/LdapProvider.java",
            "function": "lookupUser"
        },
        "id": "CVE-2020-5246-f5571bd5",
        "source": "https://github.com/traccar/traccar/commit/e4f6e74e57ab743b65d49ae00f6624a20ca0291e"
    }
]