PT-2021-23832 · Fusionpbx · Fusionpbx

Published 2021-11-05 · Updated 2023-08-08 · CVE-2021-43404

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FusionPBX versions prior to 4.5.30

Description An issue was discovered where the FAX file name may contain risky characters, potentially leading to security issues.

Recommendations For versions prior to 4.5.30, update to version 4.5.30 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing FAX file names to prevent the use of risky characters until a patch is applied. Restrict access to FAX functionality to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-43404

Affected Products

Fusionpbx

References · 4

• https://github.com/fusionpbx/fusionpbx/commit/487afc371e5c0dfbbc07cd002333c5bcd949d0f4 · Patch
• https://osv.dev/vulnerability/CVE-2021-43404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43404 · Security Note
• https://t.me/cibsecurity/31912 · Telegram Post