PT-2019-13729 · Emca · Emca Energy Logserver

Maciej Domanski · Publicado 2019-08-05 · Atualizado 2019-08-13 · CVE-2019-14521

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions EMCA Energy Logserver version 6.1.2

Description The issue concerns the api/admin/logoupload Logo File upload feature, which allows attackers to upload files to any location on the server. This is achieved through path traversal in the filename parameter.

Recommendations For EMCA Energy Logserver version 6.1.2, consider restricting access to the api/admin/logoupload endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the filename parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-14521

Produtos afetados

Emca Energy Logserver

Referências · 6

• 🔥 https://gist.github.com/ahpaleus/effb46d4a9d9c2b9a452c98f64ddc2c7 · Exploit
• https://github.com/emca-it/Energy-Log-Server-6.x/commits/master · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-14521 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-14521 · Aviso do Fabricante
• https://energylogserver.pl/en · Aviso do Fabricante
• https://energy-log-server-6x.readthedocs.io/en/latest/CHANGELOG.html · Nota