PT-2021-23831 · Fusionpbx · Fusionpbx

Published 2021-11-05 · Updated 2022-09-30 · CVE-2021-43403

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FusionPBX versions prior to 4.5.30

Description An issue was discovered in the log viewer.php Log View page, which allows an authenticated user to choose an arbitrary filename for download, not limited to the intended directory or the freeswitch.log file.

Recommendations For versions prior to 4.5.30, update to version 4.5.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the log viewer.php page to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-43403

Affected Products

Fusionpbx

References · 4

• https://github.com/fusionpbx/fusionpbx/commit/57b7bf0d6b67bda07d550b07d984a44755510d9c · Patch
• https://osv.dev/vulnerability/CVE-2021-43403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43403 · Security Note
• https://t.me/cibsecurity/50681 · Telegram Post