PT-2024-25922 · Unknown · Hc Mailinspector

Osvaldotenorio · Published 2024-05-06 · Updated 2024-07-03 · CVE-2024-34471

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions HSC Mailinspector version 5.2.17-3

Description A Path Traversal issue exists in the mliRealtimeEmails.php file, allowing an attacker to read and delete arbitrary files on the server due to improper validation of the file location by the filename parameter in the export HTML functionality. This can result in disruption of email information loading, as observed when the mliRealtimeEmails.php file itself was read and subsequently deleted, leading to a 404 error.

Recommendations For HSC Mailinspector version 5.2.17-3, consider disabling the export HTML functionality in the mliRealtimeEmails.php file until a patch is available to prevent exploitation of the Path Traversal vulnerability. Restrict access to the mliRealtimeEmails.php file to minimize the risk of arbitrary file deletion. Avoid using the filename parameter in the export HTML functionality until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-34471

Affected Products

Hc Mailinspector

References · 6

• 🔥 https://github.com/osvaldotenorio/CVE-2024-34471 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34471 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34471 · Vendor Advisory
• https://t.me/cvenotify/79258 · Telegram Post
• https://t.me/cvenotify/79301 · Telegram Post
• https://twitter.com/CVEnew/status/1787510882538250549 · Twitter Post