CVE-2024-34471
Last modified
CVE-2024-34471 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. An issue was discovered in HSC Mailinspector 5.2.17-3. A Path Traversal vulnerability (resulting in file deletion) exists in the mliRealtimeEmails.php file. EPSS estimates a 0.74% chance of exploitation in the next 30 days.
Description
An issue was discovered in HSC Mailinspector 5.2.17-3. A Path Traversal vulnerability (resulting in file deletion) exists in the mliRealtimeEmails.php file. The filename parameter in the export HTML functionality does not properly validate the file location, allowing an attacker to read and delete arbitrary files on the server. This was observed when the mliRealtimeEmails.php file itself was read and subsequently deleted, resulting in a 404 error for the file and disruption of email information loading.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hsclabs | Mailinspector | >= 5.2.17-3, <= 5.2.18 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-34471?
How severe is CVE-2024-34471?
How do I fix CVE-2024-34471?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-34466Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2024-34467ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to…6.1
- CVE-2024-34468Rukovoditel before 3.5.3 allows XSS via user_photo to My Pag…6.1
- CVE-2024-34469Rukovoditel before 3.5.3 allows XSS via user_photo to index.…7.1
- CVE-2024-3447A heap-based buffer overflow was found in the SDHCI device e…6
- CVE-2024-34470An issue was discovered in HSC Mailinspector 5.2.17-3 throug…8.6
- CVE-2024-34472An issue was discovered in HSC Mailinspector 5.2.17-3 throug…5.5
- CVE-2024-34473An issue was discovered in appmgr in O-RAN Near-RT RIC I-Rel…5.3
- CVE-2024-34474Clario through 2024-04-11 for Desktop has weak permissions f…7.8
- CVE-2024-34475Open5GS before 2.7.1 is vulnerable to a reachable assertion …7.5
- CVE-2024-34476Open5GS before 2.7.1 is vulnerable to a reachable assertion …5.3
- CVE-2024-34477configureNFS in lib/common/functions.sh in FOG through 1.5.1…7.8
Are you affected by CVE-2024-34471?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST