CVE-2020-5246

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of the LDAP query and get admin privileges. The issue only impacts instances with LDAP configuration and where users can craft their own names. This has been patched in version 4.9.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-90 CWE-74

Affected software

Vendor	Product	Versions
Traccar	Traccar	< 4.9

References

https://github.com/traccar/traccar/commit/e4f6e74e57ab743b65d49ae00f6624a20ca0291ePatch, Third Party Advisory
https://github.com/traccar/traccar/security/advisories/GHSA-v955-7g22-2p49Third Party Advisory
https://github.com/traccar/traccar/commit/e4f6e74e57ab743b65d49ae00f6624a20ca0291ePatch, Third Party Advisory
https://github.com/traccar/traccar/security/advisories/GHSA-v955-7g22-2p49Third Party Advisory

Timeline

Published: Jul 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-52477.5In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can CVE-2020-52485.3GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. Th CVE-2020-52496.5In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use CVE-2020-52506.3In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal CVE-2020-52515.3In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use CVE-2020-52524.1The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code CVE-2020-52539.8NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be e CVE-2020-52548.1In NetHack before 3.6.6, some out-of-bound values for the hilite_status option can be exploited. NetHack 3.6.6 resolves this issue.CVE-2020-52554.3In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fal CVE-2020-52568.8BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow th CVE-2020-52578.1In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before CVE-2020-52587.7In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the abil