CVEvulnerability
CVE-2019-14521
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-08-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-22
Description
The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter.
Affected configurations
• emca energy logserver 6.1.2
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://energy-log-server-6x.readthedocs.io/en/latest/CHANGELOG.html Release Notes, Third Party Advisory
- https://energylogserver.pl/en/ Vendor Advisory
- https://gist.github.com/ahpaleus/effb46d4a9d9c2b9a452c98f64ddc2c7 Exploit, Third Party Advisory
- https://github.com/emca-it/Energy-Log-Server-6.x/commits/master Patch, Third Party Advisory
- https://energy-log-server-6x.readthedocs.io/en/latest/CHANGELOG.html Release Notes, Third Party Advisory
- https://energylogserver.pl/en/ Vendor Advisory
- https://gist.github.com/ahpaleus/effb46d4a9d9c2b9a452c98f64ddc2c7 Exploit, Third Party Advisory
- https://github.com/emca-it/Energy-Log-Server-6.x/commits/master Patch, Third Party Advisory