CVE-2018-4056
9.8
CRITICAL · CVSS 3.1 · EPSS 3% (pctl 87)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.96% — more likely to be exploited than 87% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-02-05 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| coturn project | coturn |
| debian | debian linux |
References
- https://lists.debian.org/debian-lts-announce/2019/02/msg00017.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0730
- https://www.debian.org/security/2019/dsa-4373
- https://lists.debian.org/debian-lts-announce/2019/02/msg00017.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0730
- https://www.debian.org/security/2019/dsa-4373
→ the Explorer · watch your stack · NVD