PT-2025-3907 · Unknown · Invoice Ninja

Branko Brkic + 1 · Published 2025-01-14 · Updated 2025-02-17 · CVE-2025-0474

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Invoice Ninja versions 5.8.56 through 5.11.23

Description Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery (SSRF), allowing for arbitrary file read and network resource requests as the application user. This issue enables attackers to perform arbitrary file reads and network requests.

Recommendations For versions 5.8.56 through 5.11.23, as a temporary workaround, consider restricting access to sensitive files and network resources to minimize the risk of exploitation. However, the provided information does not specify a fixed version or patch, so at the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-0474

Affected Products

Invoice Ninja

References · 11

• https://github.com/invoiceninja/invoiceninja/compare/97ae948618230c1812f3223b80bf22dcb0382dc5..435780932fe19063001d79ba518815df62773d71 · Patch
• https://github.com/invoiceninja/invoiceninja/commit/2a9bf353b432d7060e85487b617151ecbc36247d · Patch
• https://osv.dev/vulnerability/CVE-2025-0474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0474 · Security Note
• https://twitter.com/CVEnew/status/1879290731191304387 · Twitter Post
• https://vulncheck.com/advisories/invoice-ninja-ssrf · Note
• https://t.me/cvedetector/15348 · Telegram Post
• https://twitter.com/Hossted_OSS/status/1881233066607444397 · Twitter Post
• https://twitter.com/brank0x42/status/1891418787414495703 · Twitter Post
• https://twitter.com/brank0x42/status/1890343700779168236 · Twitter Post
• https://twitter.com/brank0x42/status/1879879034408219118 · Twitter Post