How severe is CVE-2021-43403?

CVE-2021-43403 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2021-43403 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-43403?

CVE-2021-43403 affects Fusionpbx. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-43403?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-43403 published?

CVE-2021-43403 was published on 2022-09-29 and last updated on 2026-06-17.

CVE-2021-43403

CVE-2021-43403 is a medium-severity vulnerability in Fusionpbx with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 1% (55th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Fusionpbx
Published: 2022-09-29
Last modified: 2026-06-17

Description

An issue was discovered in FusionPBX before 4.5.30. The log_viewer.php Log View page allows an authenticated user to choose an arbitrary filename for download (i.e., not necessarily freeswitch.log in the intended directory).

Frequently asked questions

What is CVE-2021-43403?: An issue was discovered in FusionPBX before 4.5.30. The log_viewer.php Log View page allows an authenticated user to choose an arbitrary filename for download (i.e., not necessarily freeswitch.log in the intended directory).
How severe is CVE-2021-43403?: CVE-2021-43403 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2021-43403 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-43403?: CVE-2021-43403 affects Fusionpbx. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-43403?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-43403 published?: CVE-2021-43403 was published on 2022-09-29 and last updated on 2026-06-17.

References

https://github.com/fusionpbx/fusionpbx/commit/57b7bf0d6b67bda07d550b07d984a44755510d9c

Affected products (1)

cpe:2.3:a:fusionpbx:fusionpbx:*:*:*:*:*:*:*:*

More vulnerabilities in Fusionpbx

CVE-2022-35153 — Critical (CVSS 9.8): FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.
CVE-2022-28055 — Critical (CVSS 9.8): Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function.
CVE-2021-43406 — High (CVSS 8.8): An issue was discovered in FusionPBX before 4.5.30. The fax_post_size may have risky characters (it is not constrained…
CVE-2021-43405 — High (CVSS 8.8): An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained…
CVE-2021-43404 — High (CVSS 8.8): An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters.
CVE-2019-16964 — High (CVSS 8.8): app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection…

All CVEs affecting Fusionpbx →