CVE-2018-4056

2019-02-0518:00:00

talos

www.cve.org

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS

0.003

Percentile

68.4%

JSON

An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.

CNA Affected

[
  {
    "product": "coTURN",
    "vendor": "Talos",
    "versions": [
      {
        "status": "affected",
        "version": "coTURN 4.5.0.5"
      }
    ]
  }
]