CVE-2013-4137

2013-10-1122:00:00

redhat

www.cve.org

sql injection

statusnet

remote attackers

arbitrary sql commands

AI Score

8.5

Confidence

Low

EPSS

0.001

Percentile

47.9%

JSON

Multiple SQL injection vulnerabilities in StatusNet 1.0 before 1.0.2 and 1.1.0 allow remote attackers to execute arbitrary SQL commands via vectors related to user lists and “a particular tag format.”

References

status.net/2013/07/16/security-alert-sql-injection-attack-for-statusnet-1-0-x-and-1-1-x

www.openwall.com/lists/oss-security/2013/07/18/5