CVE-2019-14521

Name of the Vulnerable Software and Affected Versions EMCA Energy Logserver version 6.1.2

Description The issue concerns the api/admin/logoupload Logo File upload feature, which allows attackers to upload files to any location on the server. This is achieved through path traversal in the filename parameter.

Recommendations For EMCA Energy Logserver version 6.1.2, consider restricting access to the api/admin/logoupload endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the filename parameter in the affected API endpoint until the issue is resolved.