Remote Code Execution Vulnerability in Invoice Ninja by Invoice Ninja
CVE-2021-33898

8.1HIGH

Key Information:

Vendor

Invoiceninja

Status
Invoice Ninja
Vendor
CVE Published:
6 June 2021

What is CVE-2021-33898?

In Invoice Ninja prior to version 4.4.0, a security flaw exists due to an unsafe unserialize() call in the AccountRepository component. This vulnerability can be exploited by an attacker to deserialize arbitrary PHP classes, potentially allowing remote code execution. The exploitation requires the attacker to serve malicious input from http://www.geoplugin.net, necessitating control over that external site or effective spoofing tactics. Users of affected versions are advised to upgrade to the latest version to mitigate the risk.

References

https://github.com/invoiceninja/invoiceninja/issues/5909
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.