PT-2019-13729 · Emca · Emca Energy Logserver

Maciej Domanski · Published 2019-08-05 · Updated 2019-08-13 · CVE-2019-14521

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions EMCA Energy Logserver version 6.1.2

Description The issue concerns the api/admin/logoupload Logo File upload feature, which allows attackers to upload files to any location on the server. This is achieved through path traversal in the filename parameter.

Recommendations For EMCA Energy Logserver version 6.1.2, consider restricting access to the api/admin/logoupload endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the filename parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-14521

Affected Products

Emca Energy Logserver

References · 6

• 🔥 https://gist.github.com/ahpaleus/effb46d4a9d9c2b9a452c98f64ddc2c7 · Exploit
• https://github.com/emca-it/Energy-Log-Server-6.x/commits/master · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-14521 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14521 · Vendor Advisory
• https://energylogserver.pl/en · Vendor Advisory
• https://energy-log-server-6x.readthedocs.io/en/latest/CHANGELOG.html · Note