Vulnerability · Published Jan 14, 2025 · Assigned by VulnCheck
CVE-2025-0474Invoice Ninja PDF Rendering Server Side Request Forgery
High 7.7
In plain English
A high-severity server-side request forgery in Invoice Ninja from Invoice Ninja. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.4%top 64.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery (SSRF) allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Invoice Ninja | Invoice Ninja | 5.8.56 – through 5.11.23 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/invoiceninja/invoiceninja/commit/2a9bf353b432d7060e85487b617151ecbc36247d patch
- https://vulncheck.com/advisories/invoice-ninja-ssrf third-party-advisory
- https://github.com/invoiceninja/invoiceninja/compare/97ae948618230c1812f3223b80bf22dcb0382dc5..435780932fe19063001d79ba518815df62773d71 patch