CVE-2021-43970 is an arbitrary file upload vulnerability in the albumimages.jsp component of Quicklert for Digium version 10.0.0 (build 1043). An authenticated, low-privileged attacker can exploit this by uploading a specially crafted file, disguised as an MP3 but containing JSP code, to achieve remote code execution. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk with network accessibility, low attack complexity, and high impact on confidentiality, integrity, and availability, allowing code execution within the SYSTEM context. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), no evidence of active exploitation (KEV), and minimal community discussion or media coverage, suggesting it is not widely known or exploited in the wild.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
10.0.0CPE matchmatch criteria | cpe:2.3:a:quicklert:quicklert:10.0.0:-:*:*:*:*:digium_switchvox:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.