high7.5
CVE-2013-4137
Multiple SQL injection vulnerabilities in StatusNet 1.0 before 1.0.2 and 1.1.0 allow remote attackers to execute arbitrary SQL commands via vectors related to …
Impact
Multiple SQL injection vulnerabilities in StatusNet 1.0 before 1.0.2 and 1.1.0 allow remote attackers to execute arbitrary SQL commands via vectors related to user lists and "a particular tag format."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Status | Statusnet | Versions 1.0.0, 1.0.1, 1.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://status.net/2013/07/16/security-alert-sql-injection-attack-for-statusnet-1-0-x-and-1-1-x
- http://www.openwall.com/lists/oss-security/2013/07/18/5
- http://status.net/2013/07/16/security-alert-sql-injection-attack-for-statusnet-1-0-x-and-1-1-x
- http://www.openwall.com/lists/oss-security/2013/07/18/5