CVE-2024-34470

An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read arbitrary files on the server.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/osvaldotenorio/CVE-2024-34470	Exploit Third Party Advisory
https://github.com/osvaldotenorio/CVE-2024-34470	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hsclabs:mailinspector:*:*:*:*:*:*:*:*

History

17 Jun 2025, 16:23

Type	Values Removed	Values Added
CPE		cpe:2.3:a:hsclabs:mailinspector::::::::
References	~~() https://github.com/osvaldotenorio/CVE-2024-34470 -~~	() https://github.com/osvaldotenorio/CVE-2024-34470 - Exploit, Third Party Advisory
First Time		Hsclabs Hsclabs mailinspector

21 Nov 2024, 09:18

Type	Values Removed	Values Added
References	~~() https://github.com/osvaldotenorio/CVE-2024-34470 -~~	() https://github.com/osvaldotenorio/CVE-2024-34470 -

03 Jul 2024, 02:00

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en HSC Mailinspector 5.2.17-3 hasta v.5.2.18. Existe una vulnerabilidad de path traversal no autenticada en el archivo /public/loader.php. El parámetro de ruta no filtra adecuadamente si el archivo y el directorio pasados son parte de la raíz web, lo que permite a un atacante leer archivos arbitrarios en el servidor.
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.6
CWE		CWE-29

06 May 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-05-06 15:15

Updated : 2025-06-17 16:23

NVD link : CVE-2024-34470

Mitre link : CVE-2024-34470

CVE.ORG link : CVE-2024-34470

JSON object : View

Products Affected

hsclabs

mailinspector

CWE

CWE-29

Path Traversal: '\..\filename'

{"id": "CVE-2024-34470", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2024-05-06T15:15:24.520", "references": [{"url": "https://github.com/osvaldotenorio/CVE-2024-34470", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/osvaldotenorio/CVE-2024-34470", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-29"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read arbitrary files on the server."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en HSC Mailinspector 5.2.17-3 hasta v.5.2.18. Existe una vulnerabilidad de path traversal no autenticada en el archivo /public/loader.php. El par\u00e1metro de ruta no filtra adecuadamente si el archivo y el directorio pasados son parte de la ra\u00edz web, lo que permite a un atacante leer archivos arbitrarios en el servidor."}], "lastModified": "2025-06-17T16:23:03.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hsclabs:mailinspector:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2047F2C-68DF-40B9-913A-BF837D597293", "versionEndExcluding": "5.2.19", "versionStartIncluding": "5.2.17-3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

8.6 /10