CVE-2013-4137
StatusNet 1.0-1.0.1 and 1.1.0 - SQL Injection via User Lists and Tag Format
Title source: llmDescription
Multiple SQL injection vulnerabilities in StatusNet 1.0 before 1.0.2 and 1.1.0 allow remote attackers to execute arbitrary SQL commands via vectors related to user lists and "a particular tag format."
References (2)
Core 2
Core References
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/07/18/5
Patch, Vendor Advisory x_refsource_confirm
http://status.net/2013/07/16/security-alert-sql-injection-attack-for-statusnet-1-0-x-and-1-1-x
Scores
EPSS
0.0113
EPSS Percentile
63.0%
Details
CWE
CWE-89
Status
published
Products (3)
status/statusnet
1.0.0
status/statusnet
1.0.1
status/statusnet
1.1.0
Published
Oct 11, 2013
Tracked Since
Feb 18, 2026