CVE-2018-4056

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-02-05 · updated 2026-06-17
Weakness: CWE-89

Description

An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.

Affected products

coturn: before 4.5.0.9 — fixed in 4.5.0.9
Debian Linux: 8.0, 9.0

How to fix

Upgrade to a fixed version: coturn 4.5.0.9. Check the vendor advisory for mitigations.

References

https://lists.debian.org/debian-lts-announce/2019/02/msg00017.html
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0730
https://www.debian.org/security/2019/dsa-4373
https://lists.debian.org/debian-lts-announce/2019/02/msg00017.html
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0730
https://www.debian.org/security/2019/dsa-4373

Get alerted when CVE-2018-4056 or the next vulnerability affects your stack