CVE-2019-14521

Опубликовано: 05 авг. 2019

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter.

Ссылки

https://energy-log-server-6x.readthedocs.io/en/latest/CHANGELOG.html
Release Notes
Third Party Advisory
https://energylogserver.pl/en/
Vendor Advisory
https://gist.github.com/ahpaleus/effb46d4a9d9c2b9a452c98f64ddc2c7
Exploit
Third Party Advisory
https://github.com/emca-it/Energy-Log-Server-6.x/commits/master
Patch
Third Party Advisory
https://energy-log-server-6x.readthedocs.io/en/latest/CHANGELOG.html
Release Notes
Third Party Advisory
https://energylogserver.pl/en/
Vendor Advisory
https://gist.github.com/ahpaleus/effb46d4a9d9c2b9a452c98f64ddc2c7
Exploit
Third Party Advisory
https://github.com/emca-it/Energy-Log-Server-6.x/commits/master
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:emca:energy_logserver:6.1.2:*:*:*:*:*:*:*

EPSS

Процентиль: 54%

0.00316

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-vg2j-wxwj-mx9v