Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade quassel | Jul 30, 2024 | May 14, 2015 |
| Freebsd | — | Upgrade quassel | Dec 10, 2025 | May 16, 2015 |
| Suse | — | Upgrade quassel-mono-debuginfoUpgrade quassel-clientUpgrade quassel-debugsourceUpgrade quassel-core-debuginfoUpgrade quassel-baseUpgrade quassel-client-debuginfoUpgrade quassel-coreUpgrade quassel-mono | Dec 18, 2015 | May 14, 2015 |
| Ubuntu | — | Upgrade quassel | Nov 19, 2024 | May 14, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub