CVE-2024-34470
Hsclabs Mailinspector 5.2.17-3 – 5.2.19
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NSummary
CVE-2024-34470 is a high-severity Path Traversal: '\..\filename' (CWE-29) vulnerability in Hsclabs Mailinspector. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-34470 is an unauthenticated path traversal vulnerability affecting HSC Mailinspector versions 5.2.17-3 through 5.2.18. It resides in the /public/loader.php endpoint, where the path parameter fails to validate whether requested files or directories reside inside the webroot, allowing arbitrary file reads on the underlying server. The flaw is tracked under CWE-29 and carries a CVSS 3.1 score of 8.6.
An attacker with network access can exploit the issue without credentials or user interaction by supplying crafted path values that traverse outside the intended directory tree. Successful exploitation yields high-impact disclosure of sensitive files on the server, with the vulnerability's changed scope increasing potential reach beyond the vulnerable application.
Public proof-of-concept code demonstrating the traversal has been published on GitHub. The associated EPSS score currently stands at 0.9278 after reaching a peak of 0.9367, reflecting elevated and sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34819
Vulnerability Data
An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an…
more
attacker to read arbitrary files on the server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly neutralizes the '\..\filename' sequence before pathname resolution occurs.
Access enforcement denies requests that resolve outside the intended directory even when the traversal sequence is present.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that block this traversal vector.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover path-traversal flaws but does not itself prevent them in production code.
Application security requirements can mandate input validation and path canonicalization to block traversal sequences.
Secure architecture principles include directory sandboxing and safe file-access design that mitigate path traversal.
Secure coding standards directly require neutralizing path traversal sequences such as '\..\filename'.