CVE-2018-4056

CRITICAL EPSS 85.5%

Published Feb 5, 20197y ago · Modified Jun 17, 20262w ago

9.8 CVSS 3.1

Critical

Published Feb 5, 2019 7y ago

Last Modified Jun 17, 2026 2w ago

Description

An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.

CVSS Details

Base Score

9.8

Exploitability

3.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

85.5% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 3

Vendor	Product	Version	Range
coturn_project	coturn	*	<4.5.0.9
debian	debian_linux	8.0	any
debian	debian_linux	9.0	any

References 3

lists.debian.org https://lists.debian.org/debian-lts-announce/2019/02/msg00017.html

Mailing ListThird Party Advisory
talosintelligence.com https://talosintelligence.com/vulnerability_reports/TALOS-2018-0730

ExploitThird Party Advisory
debian.org https://www.debian.org/security/2019/dsa-4373

Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.