CVE Feed

    Dashboard / CVE / CVE-2018-4058

    CVE-2018-4058

    An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, which can lead to further attacks. An attacker can set up a relay with a loopback address as the peer on an affected TURN server to trigger this vulnerability.

    Published:Mar 21, 2019
    Last Modified:Nov 21, 2024
    EPS:Mar 21, 2019
    EPSS Score:0.00175
    CVSS Score:7.7

    Affected Products

    Vendor
    Coturn Project
    Product
    Coturn

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-40613 (CVSS 7.5) — Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute …
    CVE-2026-27624 (CVSS 7.2) — Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block lo…
    CVE-2025-69217 (CVSS 7.7) — coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a …
    CVE-2020-26262 (CVSS 7.2) — Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does…
    CVE-2020-4067 (CVSS 7) — In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized prope…
    CVE-2020-6061 (CVSS 9.8) — An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST r…
    CVE-2020-6062 (CVSS 7.5) — An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST request…
    CVE-2018-4059 (CVSS 9.8) — An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior t…
    CVE-2018-4056 (CVSS 9.8) — An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High