CVE Feed

    Dashboard / CVE / CVE-2018-4056

    CVE-2018-4056

    An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.

    Published:Feb 5, 2019
    Last Modified:Nov 21, 2024
    EPS:Feb 5, 2019
    EPSS Score:0.00516
    CVSS Score:9.8

    Affected Products

    Vendor
    Coturn Project
    Product
    Coturn
    Vendor
    Debian
    Product
    Debian Linux

    Exploits

    https://talosintelligence.com/vulnerability_reports/TALOS-2018-0730https://talosintelligence.com/vulnerability_reports/TALOS-2018-0730

    Related CVEs

    CVE-2026-40613 (CVSS 7.5) — Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute …
    CVE-2026-27624 (CVSS 7.2) — Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block lo…
    CVE-2025-69217 (CVSS 7.7) — coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a …
    CVE-2020-26262 (CVSS 7.2) — Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does…
    CVE-2020-4067 (CVSS 7) — In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized prope…
    CVE-2020-6061 (CVSS 9.8) — An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST r…
    CVE-2020-6062 (CVSS 7.5) — An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST request…
    CVE-2018-4059 (CVSS 9.8) — An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior t…
    CVE-2018-4058 (CVSS 7.7) — An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN pr…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High