CVE-2021-33898: High severity invoice ninja vulnerability
In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at http://www.geoplugin.net (cleartext HTTP), and thus a successful attack requires spoofing that site or obtaining control of it.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-33898?
CVE-2021-33898 has a critical severity as it may allow remote code execution due to unsafe deserialization.
How do I fix CVE-2021-33898?
To fix CVE-2021-33898, update Invoice Ninja to version 4.4.0 or later.
What can an attacker gain from exploiting CVE-2021-33898?
An attacker can potentially execute arbitrary PHP code on the server, leading to significant security breaches.
Which versions of Invoice Ninja are affected by CVE-2021-33898?
Invoice Ninja versions prior to 4.4.0 are affected by CVE-2021-33898.
How does CVE-2021-33898 allow for remote code execution?
CVE-2021-33898 allows remote code execution through an unsafe call to unserialize() which can be exploited by providing malicious input.