PT-2024-25921 · Unknown · Hc Mailinspector

Osvaldotenorio

·

Published

2024-05-04

·

Updated

2025-08-19

·

CVE-2024-34470

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions HSC Mailinspector versions 5.2.17-3 through 5.2.18
Description An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read arbitrary files on the server.
Recommendations For HSC Mailinspector versions 5.2.17-3 through 5.2.18, as a temporary workaround, consider restricting access to the /public/loader.php file until a patch is available. Avoid using the path parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-29

Related Identifiers

CVE-2024-34470

Affected Products

Hc Mailinspector