CVE-2018-4056

State: Published
Severity: 9.1 Critical
Published: Feb 5, 2019
Updated: Sep 17, 2024
Reserved: Jan 2, 2018

Description

An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.

Scores

CVSS	Score	Vector	Source
3.0	9.1 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	talos

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
coTURNTalos	coTURN 4.5.0.5Affected

References

[debian-lts-announce] 20190211 [SECURITY] [DLA 1671-1] coturn security updatemailing-list
DSA-4373vendor-advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0730

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.