CVE-2018-4056: SQL Injection
An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-4056?
CVE-2018-4056 is considered a high severity vulnerability due to its potential for authentication bypass in the coTURN administrator web portal.
How do I fix CVE-2018-4056?
To fix CVE-2018-4056, update coTURN to version 4.5.1.1-1.1+deb10u2 or later.
What software is affected by CVE-2018-4056?
CVE-2018-4056 affects coTURN versions prior to 4.5.0.9.
What type of vulnerability is CVE-2018-4056?
CVE-2018-4056 is an SQL injection vulnerability that allows unauthorized access to the TURN server administrator.
Can CVE-2018-4056 lead to further exploitation?
Yes, successful exploitation of CVE-2018-4056 could allow an attacker to gain administrator access to the TURN server, potentially leading to further attacks.