CVE-2021-43403: Medium severity fusionpbx vulnerability
Published Nov 5, 2021
·Updated
An issue was discovered in FusionPBX before 4.5.30. The logviewer.php Log View page allows an authenticated user to choose an arbitrary filename for download (i.e., not necessarily freeswitch.log in the intended directory).
Affected Software
1 affected component
FusionPBX Fusionpbx<4.5.30
Remediation
Event History
Nov 5, 2021
CVE Published
via MITRE·05:36 PM
Data Sourced
via MITRE·05:36 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2021-43403?
CVE-2021-43403 has a medium severity due to its potential for data exposure through arbitrary file download.
2
How do I fix CVE-2021-43403?
To fix CVE-2021-43403, upgrade FusionPBX to version 4.5.30 or later.
3
Who is affected by CVE-2021-43403?
Any user utilizing FusionPBX versions prior to 4.5.30 is affected by CVE-2021-43403.
4
What type of vulnerability is CVE-2021-43403?
CVE-2021-43403 is classified as a local file inclusion vulnerability.
5
What is the consequence of exploiting CVE-2021-43403?
Exploiting CVE-2021-43403 allows authenticated users to download arbitrary files, potentially leading to information disclosure.