PT-2021-23834 · Fusionpbx · Fusionpbx

Published 2021-11-05 · Updated 2021-11-09 · CVE-2021-43406

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FusionPBX versions prior to 4.5.30

Description An issue was discovered where the fax post size may have risky characters because it is not constrained to preset values.

Recommendations For versions prior to 4.5.30, update to version 4.5.30 or later to resolve the issue. As a temporary workaround, consider restricting the input for fax post size to preset values until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-43406

Affected Products

Fusionpbx

References · 4

• https://github.com/fusionpbx/fusionpbx/commit/0377b2152c0e59c8f35297f9a9b6ee335a62d963 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-43406 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43406 · Vendor Advisory
• https://t.me/cibsecurity/31917 · Telegram Post