invoiceninja is vulnerable to Cross-site Scripting
The advisory, in context
invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 5.3.35
Fixed in 5.3.35
372 explicitly affected versions
v1.0.2, v1.0.3, v1.1.0, v1.1.1, v1.1.2, v1.2.0, v1.2.1, v1.2.2, v1.3.0, v1.3.1, v1.3.2, v1.3.3, v1.4.0, v1.5.0, v1.5.1, v1.5.2, v1.6.0, v1.6.1, v1.7.0, v1.7.1, v1.7.2, v2.0.0, v2.0.0_RC1, v2.0.1, v2.1.0, v2.1.1, v2.1.2, v2.2.0, v2.2.1, v2.2.2, v2.3.0, v2.3.1, v2.3.2, v2.3.3, v2.3.4, v2.4.0, v2.4.1, v2.4.2, v2.4.3, v2.4.4, v2.4.5, v2.4.6, v2.4.7, v2.4.8, v2.4.8.1, v2.4.9, v2.4.9.1, v2.4.9.2, v2.4.9.3, v2.4.9.4, v2.4.9.5, v2.4.9.6, v2.5.0, v2.5.0.1, v2.5.0.2, v2.5.0.3, v2.5.0.4, v2.5.1, v2.5.1.1, v2.5.1.2, v2.5.1.3, v2.5.2, v2.5.2.1, v2.5.2.2, v2.6, v2.6.1, v2.6.10, v2.6.11, v2.6.2, v2.6.3, v2.6.4, v2.6.5, v2.6.6, v2.6.7, v2.6.8, v2.6.9, v2.7, v2.7.1, v2.7.2, v2.8, v2.8.1, v2.8.2, v2.9.0, v2.9.1, v2.9.2, v2.9.3, v2.9.4, v2.9.5, v3.0.0, v3.0.1, v3.0.2, v3.0.3, v3.0.4, v3.0.5, v3.1.0, v3.1.1, v3.1.2, v3.1.3, v3.2.0, v3.2.1, v3.3.0, v3.3.1, v3.3.3, v3.4.0, v3.4.1, v3.4.2, v3.5.0, v3.5.1, v3.6.0, v3.6.1, v3.7.0, v3.7.1, v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1, v3.9.2, v4.0.0, v4.0.1, v4.1.0, v4.1.1, v4.1.2, v4.1.3, v4.1.4, v4.1.5, v4.2.0, v4.2.1, v4.2.2, v4.3.0, v4.3.1, v4.4.0, v4.4.1, v4.4.2, v4.4.3, v4.4.4, v4.5.0, v4.5.1, v4.5.10, v4.5.11, v4.5.12, v4.5.13, v4.5.14, v4.5.15, v4.5.16, v4.5.17, v4.5.18, v4.5.19, v4.5.2, v4.5.20, v4.5.21, v4.5.22, v4.5.23, v4.5.24, v4.5.25, v4.5.26, v4.5.27, v4.5.28, v4.5.29, v4.5.3, v4.5.30, v4.5.31, v4.5.32, v4.5.33, v4.5.34, v4.5.35, v4.5.36, v4.5.37, v4.5.38, v4.5.39, v4.5.4, v4.5.40, v4.5.41, v4.5.42, v4.5.43, v4.5.44, v4.5.45, v4.5.46, v4.5.47, v4.5.48, v4.5.49, v4.5.5, v4.5.50, v4.5.6, v4.5.7, v4.5.8, v4.5.9, v5.0, v5.0.1, v5.0.10, v5.0.11, v5.0.12, v5.0.13, v5.0.16, v5.0.17, v5.0.18, v5.0.19, v5.0.2, v5.0.20, v5.0.21, v5.0.22, v5.0.23, v5.0.24, v5.0.25, v5.0.26, v5.0.27, v5.0.28, v5.0.29, v5.0.3, v5.0.30, v5.0.31, v5.0.32, v5.0.33, v5.0.34, v5.0.35, v5.0.36, v5.0.37, v5.0.38, v5.0.39, v5.0.4, v5.0.40, v5.0.41, v5.0.42, v5.0.43, v5.0.44, v5.0.45, v5.0.46, v5.0.47, v5.0.48, v5.0.49, v5.0.5, v5.0.50, v5.0.51, v5.0.52, v5.0.53, v5.0.54, v5.0.55, v5.0.56, v5.0.6, v5.0.7, v5.0.8, v5.0.9, v5.1.0, v5.1.1, v5.1.10, v5.1.11, v5.1.12, v5.1.13, v5.1.14, v5.1.15, v5.1.16, v5.1.17, v5.1.18, v5.1.19, v5.1.2, v5.1.20, v5.1.21, v5.1.22, v5.1.23, v5.1.24, v5.1.25, v5.1.26, v5.1.27, v5.1.28, v5.1.29, v5.1.3, v5.1.30, v5.1.31, v5.1.32, v5.1.33, v5.1.34, v5.1.35, v5.1.36, v5.1.37, v5.1.38, v5.1.39, v5.1.4, v5.1.40, v5.1.41, v5.1.42, v5.1.43, v5.1.44, v5.1.45, v5.1.46, v5.1.47, v5.1.48, v5.1.49, v5.1.5, v5.1.50, v5.1.51, v5.1.52, v5.1.53, v5.1.54, v5.1.55, v5.1.56, v5.1.57, v5.1.58, v5.1.59, v5.1.6, v5.1.60, v5.1.61, v5.1.62, v5.1.63, v5.1.64, v5.1.65, v5.1.66, v5.1.67, v5.1.68, v5.1.69, v5.1.7, v5.1.70, v5.1.71, v5.1.72, v5.1.73, v5.1.74, v5.1.8, v5.1.9, v5.2.0, v5.2.1, v5.2.10, v5.2.11, v5.2.12, v5.2.13, v5.2.14, v5.2.15, v5.2.16, v5.2.17, v5.2.18, v5.2.19, v5.2.2, v5.2.3, v5.2.4, v5.2.5, v5.2.6, v5.2.7, v5.2.8, v5.2.9, v5.3.0, v5.3.1, v5.3.10, v5.3.11, v5.3.12, v5.3.13, v5.3.14, v5.3.15, v5.3.16, v5.3.17, v5.3.18, v5.3.19, v5.3.2, v5.3.20, v5.3.21, v5.3.22, v5.3.23, v5.3.24, v5.3.25, v5.3.26, v5.3.27, v5.3.28, v5.3.29, v5.3.3, v5.3.30, v5.3.31, v5.3.32, v5.3.33, v5.3.34, v5.3.4, v5.3.5, v5.3.6, v5.3.7, v5.3.8, v5.3.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.3.35"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v1.0.2",
"v1.0.3",
"v1.1.0",
"v1.1.1",
"v1.1.2",
"v1.2.0",
"v1.2.1",
"v1.2.2",
"v1.3.0",
"v1.3.1",
"v1.3.2",
"v1.3.3",
"v1.4.0",
"v1.5.0",
"v1.5.1",
"v1.5.2",
"v1.6.0",
"v1.6.1",
"v1.7.0",
"v1.7.1",
"v1.7.2",
"v2.0.0",
"v2.0.0_RC1",
"v2.0.1",
"v2.1.0",
"v2.1.1",
"v2.1.2",
"v2.2.0",
"v2.2.1",
"v2.2.2",
"v2.3.0",
"v2.3.1",
"v2.3.2",
"v2.3.3",
"v2.3.4",
"v2.4.0",
"v2.4.1",
"v2.4.2",
"v2.4.3",
"v2.4.4",
"v2.4.5",
"v2.4.6",
"v2.4.7",
"v2.4.8",
"v2.4.8.1",
"v2.4.9",
"v2.4.9.1",
"v2.4.9.2",
"v2.4.9.3",
"v2.4.9.4",
"v2.4.9.5",
"v2.4.9.6",
"v2.5.0",
"v2.5.0.1",
"v2.5.0.2",
"v2.5.0.3",
"v2.5.0.4",
"v2.5.1",
"v2.5.1.1",
"v2.5.1.2",
"v2.5.1.3",
"v2.5.2",
"v2.5.2.1",
"v2.5.2.2",
"v2.6",
"v2.6.1",
"v2.6.10",
"v2.6.11",
"v2.6.2",
"v2.6.3",
"v2.6.4",
"v2.6.5",
"v2.6.6",
"v2.6.7",
"v2.6.8",
"v2.6.9",
"v2.7",
"v2.7.1",
"v2.7.2",
"v2.8",
"v2.8.1",
"v2.8.2",
"v2.9.0",
"v2.9.1",
"v2.9.2",
"v2.9.3",
"v2.9.4",
"v2.9.5",
"v3.0.0",
"v3.0.1",
"v3.0.2",
"v3.0.3",
"v3.0.4",
"v3.0.5",
"v3.1.0",
"v3.1.1",
"v3.1.2",
"v3.1.3",
"v3.2.0",
"v3.2.1",
"v3.3.0",
"v3.3.1",
"v3.3.3",
"v3.4.0",
"v3.4.1",
"v3.4.2",
"v3.5.0",
"v3.5.1",
"v3.6.0",
"v3.6.1",
"v3.7.0",
"v3.7.1",
"v3.7.2",
"v3.8.0",
"v3.8.1",
"v3.9.0",
"v3.9.1",
"v3.9.2",
"v4.0.0",
"v4.0.1",
"v4.1.0",
"v4.1.1",
"v4.1.2",
"v4.1.3",
"v4.1.4",
"v4.1.5",
"v4.2.0",
"v4.2.1",
"v4.2.2",
"v4.3.0",
"v4.3.1",
"v4.4.0",
"v4.4.1",
"v4.4.2",
"v4.4.3",
"v4.4.4",
"v4.5.0",
"v4.5.1",
"v4.5.10",
"v4.5.11",
"v4.5.12",
"v4.5.13",
"v4.5.14",
"v4.5.15",
"v4.5.16",
"v4.5.17",
"v4.5.18",
"v4.5.19",
"v4.5.2",
"v4.5.20",
"v4.5.21",
"v4.5.22",
"v4.5.23",
"v4.5.24",
"v4.5.25",
"v4.5.26",
"v4.5.27",
"v4.5.28",
"v4.5.29",
"v4.5.3",
"v4.5.30",
"v4.5.31",
"v4.5.32",
"v4.5.33",
"v4.5.34",
"v4.5.35",
"v4.5.36",
"v4.5.37",
"v4.5.38",
"v4.5.39",
"v4.5.4",
"v4.5.40",
"v4.5.41",
"v4.5.42",
"v4.5.43",
"v4.5.44",
"v4.5.45",
"v4.5.46",
"v4.5.47",
"v4.5.48",
"v4.5.49",
"v4.5.5",
"v4.5.50",
"v4.5.6",
"v4.5.7",
"v4.5.8",
"v4.5.9",
"v5.0",
"v5.0.1",
"v5.0.10",
"v5.0.11",
"v5.0.12",
"v5.0.13",
"v5.0.16",
"v5.0.17",
"v5.0.18",
"v5.0.19",
"v5.0.2",
"v5.0.20",
"v5.0.21",
"v5.0.22",
"v5.0.23",
"v5.0.24",
"v5.0.25",
"v5.0.26",
"v5.0.27",
"v5.0.28",
"v5.0.29",
"v5.0.3",
"v5.0.30",
"v5.0.31",
"v5.0.32",
"v5.0.33",
"v5.0.34",
"v5.0.35",
"v5.0.36",
"v5.0.37",
"v5.0.38",
"v5.0.39",
"v5.0.4",
"v5.0.40",
"v5.0.41",
"v5.0.42",
"v5.0.43",
"v5.0.44",
"v5.0.45",
"v5.0.46",
"v5.0.47",
"v5.0.48",
"v5.0.49",
"v5.0.5",
"v5.0.50",
"v5.0.51",
"v5.0.52",
"v5.0.53",
"v5.0.54",
"v5.0.55",
"v5.0.56",
"v5.0.6",
"v5.0.7",
"v5.0.8",
"v5.0.9",
"v5.1.0",
"v5.1.1",
"v5.1.10",
"v5.1.11",
"v5.1.12",
"v5.1.13",
"v5.1.14",
"v5.1.15",
"v5.1.16",
"v5.1.17",
"v5.1.18",
"v5.1.19",
"v5.1.2",
"v5.1.20",
"v5.1.21",
"v5.1.22",
"v5.1.23",
"v5.1.24",
"v5.1.25",
"v5.1.26",
"v5.1.27",
"v5.1.28",
"v5.1.29",
"v5.1.3",
"v5.1.30",
"v5.1.31",
"v5.1.32",
"v5.1.33",
"v5.1.34",
"v5.1.35",
"v5.1.36",
"v5.1.37",
"v5.1.38",
"v5.1.39",
"v5.1.4",
"v5.1.40",
"v5.1.41",
"v5.1.42",
"v5.1.43",
"v5.1.44",
"v5.1.45",
"v5.1.46",
"v5.1.47",
"v5.1.48",
"v5.1.49",
"v5.1.5",
"v5.1.50",
"v5.1.51",
"v5.1.52",
"v5.1.53",
"v5.1.54",
"v5.1.55",
"v5.1.56",
"v5.1.57",
"v5.1.58",
"v5.1.59",
"v5.1.6",
"v5.1.60",
"v5.1.61",
"v5.1.62",
"v5.1.63",
"v5.1.64",
"v5.1.65",
"v5.1.66",
"v5.1.67",
"v5.1.68",
"v5.1.69",
"v5.1.7",
"v5.1.70",
"v5.1.71",
"v5.1.72",
"v5.1.73",
"v5.1.74",
"v5.1.8",
"v5.1.9",
"v5.2.0",
"v5.2.1",
"v5.2.10",
"v5.2.11",
"v5.2.12",
"v5.2.13",
"v5.2.14",
"v5.2.15",
"v5.2.16",
"v5.2.17",
"v5.2.18",
"v5.2.19",
"v5.2.2",
"v5.2.3",
"v5.2.4",
"v5.2.5",
"v5.2.6",
"v5.2.7",
"v5.2.8",
"v5.2.9",
"v5.3.0",
"v5.3.1",
"v5.3.10",
"v5.3.11",
"v5.3.12",
"v5.3.13",
"v5.3.14",
"v5.3.15",
"v5.3.16",
"v5.3.17",
"v5.3.18",
"v5.3.19",
"v5.3.2",
"v5.3.20",
"v5.3.21",
"v5.3.22",
"v5.3.23",
"v5.3.24",
"v5.3.25",
"v5.3.26",
"v5.3.27",
"v5.3.28",
"v5.3.29",
"v5.3.3",
"v5.3.30",
"v5.3.31",
"v5.3.32",
"v5.3.33",
"v5.3.34",
"v5.3.4",
"v5.3.5",
"v5.3.6",
"v5.3.7",
"v5.3.8",
"v5.3.9"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2021-3977
- https://github.com/invoiceninja/invoiceninja/commit/1186eaa82375692d01d5ef3369c5b7bc7315b55f
- https://github.com/invoiceninja/invoiceninja
- https://github.com/invoiceninja/invoiceninja/releases/tag/v5.3.35
- https://huntr.dev/bounties/99c4ed09-b66f-474a-bd74-eeccf9339fde