What’s Vulnerable › Vulnerabilities

CVE-2021-43403

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-29 · updated 2026-06-17

Description

An issue was discovered in FusionPBX before 4.5.30. The log_viewer.php Log View page allows an authenticated user to choose an arbitrary filename for download (i.e., not necessarily freeswitch.log in the intended directory).

Affected products

• fusionpbx: before 4.5.30 — fixed in 4.5.30

How to fix

Upgrade to a fixed version: fusionpbx 4.5.30. Check the vendor advisory for mitigations.

References

• https://github.com/fusionpbx/fusionpbx/commit/57b7bf0d6b67bda07d550b07d984a44755510d9c
• https://github.com/fusionpbx/fusionpbx/commit/57b7bf0d6b67bda07d550b07d984a44755510d9c

Get alerted when CVE-2021-43403 or the next vulnerability affects your stack